A site from a multi-site indexer cluster needs to be decommissioned. Which of the following actions must be taken?
A site from a multi-site indexer cluster needs to be decommissioned. Which of the following actions must be taken?
To decommission a site from a multi-site indexer cluster, it is necessary to remove the site from the list of available sites. This ensures that no new data is sent to the decommissioned site. The action of creating an alias for where the new data should be sent is not required as part of the decommissioning process. Thus, the correct action is to simply remove the site from the list of available sites.
Answer D
Hello, could you please explain why D? According to https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Decommissionasite, site mapping does not requiere creating an alias. Thank you.
I wonder if they are confusing alias and map
D is OK
D is fine
site mapping
Link https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Decommissionasite
D is the correct one.
Hello, could you please explain why D? According to https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Decommissionasite, site mapping does not requiere creating an alias. Thank you.
I think the site mapping is actually an alias of the site. You map the decommissioned site to an existing one, so forwarders can send the data to the new site, which is aliased ("mapped").