A customer has a search cluster (SHC) of six members split evenly between two data centers (DC). The customer is concerned with network connectivity between the two DCs due to frequent outages. Which of the following is true as it relates to SHC resiliency when a network outage occurs between the two DCs?
When there is a network outage splitting a search head cluster (SHC) evenly across two data centers, the SHC is unable to elect a new captain because neither side holds a majority of members. Without a captain, the cluster cannot perform certain functions, such as running scheduled searches and generating alerts. Ad hoc searches may still function independently on each site, but the overall scheduling of processes will cease until connectivity is restored and a new captain can be elected from the majority. Thus, the SHC will stop all scheduled search activity during the network outage.
It is B https://docs.splunk.com/Documentation/Splunk/8.2.1/DistSearch/DeploymultisiteSHC
B seems correct answers, as both site have equal SH and captain cannot be elected. During this time, the members on the other sites can continue to function as independent search heads. However, they will only be able to service ad hoc searches. Scheduled reports and alerts will not run, because, in a cluster, the scheduling function is relegated to the captain.
Its C. Both sites will have 3 Shs. Each site will be able to elect a new captain independently and all functionality remains the same
I found that. shc in 6 members need 4 members to election. https://docs.splunk.com/Documentation/Splunk/8.2.1/DistSearch/SHCarchitecture#Captain_election To become captain, a member needs to win a majority vote of all members. For example, in a seven-member cluster, election requires four votes. Similarly, a six-member cluster also requires four votes.
I think B is correct
B is the correct one. SHC will lose the majority to elect a new captain.
B is the one
To function properly the Captain needs the global majority across all sites to be alive. When one of the sites fail, we are left with 3 members only, which is not 51% majority and a Captain cannot be elected. Scheduled searches will be stopped. Ref: https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/DeploymultisiteSHC#What_happens_when_the_site_with_the_majority_fails