Discuss Splunk SPLK-1003 Exam Topic 10 Question 120

A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X, Y). During a search executed on search head X, indexer A crashes. What is Splunk's response?

AUpdate the user in Splunk web informing them that the results of their search may be incomplete.

BRepeat the search request on indexer B without informing the user.

CUpdate the user in Splunk web that their results may be incomple and that Splunk will try to re-execute the search.

DInform the user in Splunk web that their results may be incomplete and have them attempt the search from search head Y.

Suggested Answer: A

This is explained in the Splunk documentation1, which states:

If an indexer goes down during a search, the search head notifies you that the results might be incomplete. The search head does not attempt to re-run the search on another indexer.

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

30 comments · newest first

Kenneth 6 months ago

C is solid. It shows Splunk is proactive about search integrity.

Linette 6 months ago

B feels risky. Users deserve to know what's happening.

Mattie 6 months ago

I like D. Redirecting to search head Y is a good backup plan.

Novella 7 months ago

Option A seems too vague. Users need more than just a warning.

Ben 7 months ago

I agree with C too. Transparency is key in these situations.

Peggie 7 months ago

I think option C is the best choice. It keeps the user informed.

Allene 8 months ago

D seems a bit extreme, why not just fix the search on X?

Jessenia 8 months ago

I agree with C, communication is key in these situations!

Kristel 8 months ago

Wait, can they really just repeat the search on B without telling anyone? Sounds sketchy.

Aron 8 months ago

Definitely A, they need to let the user know about incomplete results.

Tijuana 8 months ago

D) Inform the user in Splunk web that their results may be incomplete and have them attempt the search from search head Y. Gotta keep those users in the loop!

Deane 8 months ago

B) Repeat the search request on indexer B without informing the user. Sneaky, but efficient!

Alexia 9 months ago

I vaguely recall something about directing users to another search head if there's an issue, which sounds like option D. But I’m not entirely sure if that’s the right approach in this scenario.

Annamaria 9 months ago

I feel like option C makes the most sense since it mentions updating the user and trying to re-execute the search. But I’m not completely confident.

Viva 9 months ago

I remember a practice question where the system just repeated the search on another indexer without notifying the user. Could that be option B here?

Veta 9 months ago

I think Splunk might try to inform the user about the incomplete results, but I'm not sure if it would automatically re-execute the search.

Geraldine 9 months ago

Yeah, I agree with Emily. Letting the user know upfront about the potential incomplete results and giving them the option to try the search on the other head seems like the best way to handle this scenario.

Effie 9 months ago

Based on my understanding, I think option D is the way to go. Informing the user and having them try the search from the other search head seems like the most transparent and helpful approach.

Tammy 10 months ago

Hmm, I guess Splunk doesn't want to keep the user in the dark. Transparency is key!

Tyra 10 months ago

I'm a bit confused on the specifics of how Splunk handles indexer failures. I'll need to review the material on that to make sure I understand the right approach.

Lashawn 10 months ago

C) Update the user in Splunk web that their results may be incomplete and that Splunk will try to re-execute the search.

Matthew 10 months ago

I think it's C, they should inform the user and try again.

Jesusa 10 months ago

D) Inform the user in Splunk web that their results may be incomplete and have them attempt the search from search head Y.

Jules 11 months ago

Okay, let's see. If indexer A crashes, that could definitely impact the search results. I'm thinking C or D might be the best options here.

Devora 11 months ago

Hmm, this seems like a tricky one. I'll need to think carefully about the different indexer and search head scenarios.

Chara 5 months ago

↳ replying to Devora

I agree with C, it makes the most sense.

Laura 5 months ago

↳ replying to Devora

B seems too risky.

Chantell 6 months ago

↳ replying to Devora

What about D? That sounds reasonable.

Angelyn 6 months ago

↳ replying to Devora

I'm leaning towards A.

Kallie 6 months ago

↳ replying to Devora

I think it might be option C.

Splunk SPLK-1003 Exam - Topic 10 Question 120 Discussion