A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
A . Via Splunk Web.
B . Directly edit SPLUNK_HOME/etc./system/local/server.conf
C . Run a Splunk edit cluster-config command from the CLI.
D . Directly edit SPLUNK_HOME/etc/system/default/server.conf

View Answer

Answer: B, C

Explanation:

A multi-site indexer cluster can be configured by directly editing SPLUNK_HOME/etc/system/local/server.conf or running a splunk edit cluster-config command from the CLI. These methods allow the administrator to specify the site attribute for each indexer node and the site_replication_factor and site_search_factor for the cluster. Configuring a multi-site indexer cluster via Splunk Web or directly editing SPLUNK_HOME/etc/system/default/server.conf are not supported methods. For more information, see Configure the indexer cluster with server.conf in the Splunk documentation.