A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
A multisite indexer cluster can be configured either by directly editing the SPLUNK_HOME/etc/system/local/server.conf file or by running the splunk edit cluster-config command from the CLI. Configuration via Splunk Web is not supported for this specific setup, and editing SPLUNK_HOME/etc/system/default/server.conf is incorrect as it is intended for default settings which should not be modified directly.
B & C is the correct answer.
B and C Configure multisite nodes To deploy and configure multisite cluster nodes, you must directly edit server.conf or use the CLI. You cannot use Splunk Web.
Correct answers are B&C
B & C is correct Configure multisite nodes To deploy and configure multisite cluster nodes, you must directly edit server.conf or use the CLI. You cannot use Splunk Web. Multisite-specific configuration settings When you deploy a multisite cluster, you configure the same settings as for single-site, along with some additional settings to specify the set of sites and the location of replicated and searchable copies across the sites. https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Multisitedeploymentoverview
https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Multisitedeploymentoverview Configure with server.conf To configure a multisite master node with server.conf, see "Configure multisite indexer clusters with server.conf". Configure with the CLI To configure a multisite master node with the CLI, see "Configure multisite indexer clusters with the CLI"
B&C are correct
https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Multisitedeploymentoverview#Configure_multisite_nodes:~:text=To%20deploy%20and%20configure%20multisite%20cluster%20nodes%2C%20you%20must%20directly%20edit%20server.conf%20or%20use%20the%20CLI.%20You%20cannot%20use%20Splunk%20Web.
A. Via Splunk Web. C. Run a `splunk edit cluster-config` command from the CLI. Explanation: - **A. Via Splunk Web**: Splunk Web provides a graphical interface for configuring a multi-site indexer cluster. - **C. Run a `splunk edit cluster-config` command from the CLI**: This CLI command allows direct configuration of the indexer cluster setup, including multi-site configurations. Directly editing configuration files (`B` and `D`) is generally not recommended as it can lead to configuration errors or inconsistencies unless done with caution and proper understanding of Splunk's configuration management practices. SOURCE : https://bitly.cx/8fAY7