When adding or rejoining a member to a search head cluster, the following error is displayed:
Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.
What corrective action should be taken?

1. A. Restart the search head.
2. B. Run the splunk apply shcluster-bundle command from the deployer.
3. C. Run the clean raft command on all members of the search head cluster.
4. D. Run the splunk resync shcluster-replicated-config command on this member.

Correct Answer: B

Of the following types of files within an index bucket, which file type may consume the most disk?

1. A. Rawdata
2. B. Bloom filter
3. C. Metadata (.data)
4. D. Inverted index (.tsidx)

Correct Answer: B

Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

1. A. High performance SAN should never be used.
2. B. Enable NFS for storing hot and warm buckets.
3. C. The recommended RAID setup is RAID 10 (1 + 0).
4. D. Virtualized environments are usually preferred over bare metal for Splunk indexers.

Correct Answer: C

A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:
[clustering] mode = master
replication_factor = 2
pass4SymmKey = password123
Which of the following statements
describe this Splunk instance?
(Select all that apply.)

1. A. This is a multi-site cluster.
2. B. This cluster's search factor is 2.
3. C. This Splunk instance needs to be restarted.
4. D. This instance is missing the master_uri attribute.

Correct Answer: AC