MENU
Which Splunk component is mandatory when implementing a search head cluster?
This is a mandatory Splunk component when implementing a search head cluster, as it is responsible for distributing the configuration updates and app bundles to the cluster members1.The deployer is a separate instance that communicates with the cluster manager and pushes the changes to the search heads1. The other options are not mandatory components for a search head cluster.Option A, Captain Server, is not a component, but a role that is dynamically assigned to one of the search heads in the cluster2.The captain coordinates the replication and search activities among the cluster members2.Option C, Cluster Manager, is a component for an indexer cluster, not a search head cluster3.The cluster manager manages the replication and search factors, and provides a web interface for monitoring and managing the indexer cluster3.Option D, RAFT Server, is not a component, but a protocol that is used by the search head cluster to elect the captain and maintain the cluster state4. Therefore, option B is the correct answer, and options A, C, and D are incorrect.
1: Use the deployer to distribute apps and configuration updates2: About the captain3: About the cluster manager4: How a search head cluster works