When are knowledge bundles distributed to search peers?
When are knowledge bundles distributed to search peers?
Knowledge bundles are distributed to search peers when a distributed search is initiated. This is because, in a distributed search, the search head needs to share its knowledge objects, such as saved searches and event types, with its search peers to properly execute queries across the indexes. Therefore, the correct answer is when a distributed search is initiated.
D is correct https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Whatsearchheadssend
Agreed D. Quoting the Splunk reference URL... "The search head replicates the knowledge bundle periodically in the background or when initiating a search. " "As part of the distributed search process, the search head replicates and distributes its knowledge objects to its search peers, or indexers. Knowledge objects include saved searches, event types, and other entities used in searching accorss indexes. The search head needs to distribute this material to its search peers so that they can properly execute queries on its behalf."
D is correct. Pag 193 Sys Adm PDF
The correct answer is D. When a distributed search is initiated. Knowledge bundles are collections of configuration files, saved searches, and other knowledge objects that are used to share knowledge across the distributed environment in Splunk. When a distributed search is initiated, the search head distributes the relevant knowledge bundle to the search peers that are participating in the search. Option A is incorrect because knowledge bundles are not distributed to search peers after a user logs in. Option B is incorrect because restarting Splunk does not trigger the distribution of knowledge bundles to search peers. Option C is also incorrect because knowledge bundles are not distributed to search peers when adding a new search peer. Instead, when a new search peer is added to a search head cluster or a distributed search environment, the knowledge bundle is automatically distributed to the new search peer.
D is correct