Splunk Enterprise Certified Architect Practice Test

Which methods can be used to configure a multi-site indexer cluster?

1. Via Splunk Web

2. Directly edit the server.conf file in the system/local directory

3. Run a splunk edit cluster-config command from the CLI

4. Directly edit the server.conf file in the system/default directory

The correct answer is: Directly edit the server.conf file in the system/local directory

The configuration of a multi-site indexer cluster can indeed be accomplished by directly editing the server.conf file in the system/local directory. This is because the system/local directory is meant for configuration settings that are unique to a specific Splunk instance. When you make changes to configuration files in this directory, they take precedence over the default settings configured in the system/default directory. This allows you to tailor the settings for your specific environment and requirements. Using the server.conf file for configuring a multi-site indexer cluster is essential as it holds crucial settings related to replication, search factor, and site awareness, which are vital for ensuring that the cluster functions properly across multiple sites. In contrast, other options mentioned may not be conducive or appropriate. For instance, while the use of Splunk Web provides a graphical interface for many configurations, it may not always expose all the necessary options for configuring a multi-site indexer cluster in detail. Similarly, while the command line interface option (splunk edit cluster-config) is valid for certain configurations, it may have limitations and not cover every aspect that can be adjusted through the server.conf file. Editing the server.conf file in the system/default directory is also not advisable for production environments since changes made there would apply globally across all instances