When running a real-time search, search results are pulled from which Splunk component?

When running a real-time search, search results are pulled from which Splunk component?
A . Heavy forwarders and search peers
B . Heavy forwarders
C . Search heads
D . Search peers

View Answer

Answer: C

Explanation:

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.1/Search/Restrictrealtimesearch