When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?
When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?
The correct order of operations for adding a new member to a Search Head Cluster (SHC) involves first deleting Splunk Enterprise if it exists on the instance, then installing and initializing the instance, and finally joining the SHC. This ensures that the new instance is clean and properly configured before it becomes part of the cluster.
My answer is A
pg 197 | Cluster
Question and answers do not fit well, however among the given answers A is the best.
A Always use new Instances
A is correct
It should be A, however A is only for adding a new member, not decommissioning... there's steps you have to do to remove a member from a search head cluster that would be done prior to A.
It should be A, however A is only for adding a new member, not decommissioning... there's steps you have to do to remove a member from a search head cluster that would be done prior to A.
A. 1. Delete Splunk Enterprise, if it exists. 2. Install and initialize the instance. 3. Join the SHC.
I think the question should have been, "When adding a new or decommissioned member to a Search Head Cluster (SHC), what is the proper order of operations?". Page 185 of the latest Splunk Cluster Administration PDF.