Managing Indexers And Clusters Of Indexers

Question 1

How many manager nodes can be in cluster

Answer 1

Only one manager node allowed

Question 2

Functions of manager node

Answer 2

Coordinate activities of peer nodes

Question 3

Does manger node store or replicate data

Answer 3

No, it does not, aside from its own internal data

Question 4

Can manager node do double duty as peer node or search node

Answer 4

No. Must perform only single indexer cluster role

Question 5

Can manager node share machine with peer?

Answer 5

No

Question 6

At what stage you enable manager node?

Answer 6

This us first step in enabling cluster, done before setting up peer nodes

Question 7

Ways to enable manager node

Answer 7

From Splunk Web
Directly edit manager’s server.conf
Use CLI: edit cluster-config

Question 8

Enable indexer as manager node process

Answer 8

Settings > Distributed environment > Indexer clustering > enable indexer clustering > Manager node > Next

Configure Replication Factor, Search Factor, Security Key, Cluster Label

Enable manager node > restart Splunk

Question 9

Replication factor

Answer 9

Determines how many copies of data cluster maintains. Default 3

Question 10

Search factor

Answer 10

Determines how many immediately searchable copies of data cluster maintains. Default 2

Question 11

Security Key

Answer 11

Authenticates communication between manager node and peers and search heads

Question 12

Cluster label

Answer 12

Anne if the cluster in monitoring console