The customer has an indexer cluster supporting a wide variety of search needs, including scheduled search, data model acceleration, and summary indexing.
Here is an excerpt from the cluster mater's server.conf:
Which strategy represents the minimum and least disruptive change necessary to protect the searchability of the indexer cluster in case of indexer failure?
The appropriate strategy to protect the searchability of the indexer cluster with the minimum and least disruptive change is to leave the replication factor at 2, increase the search factor to 2, and enable summary replication. Increasing the search factor ensures that there are enough searchable copies of the data, and enabling summary replication will safeguard summary data without requiring a complete overhaul of the system configuration or a more complex multi-site setup. This approach balances protection and minimal disruption to the existing cluster configuration.
The correct answer is B https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Clustersandsummaryreplication
Answer is "B" as is "...minimum and least disruptive change"
I would also say that B is the correct one.
B is the correct
D is best choice
https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/Migratetomultisite
"...minimum and least disruptive change"...migrating to multisite, is not that.
Splunk reference is for rep factor of 3 in order to tolerate a failure of 2 nodes; which assumes that the cluster is made of of the min of 3 nodes. B would assume that the cluster is 2 nodes and the nodes would have a search each https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Thereplicationfactor