Splunk Enterprise Certified Architect Practice Test

Which server.conf attribute should be added to the master node's server.conf file when decommissioning a site in an indexer cluster?

1. site_mappings

2. available_sites

3. site_search_factor

4. site_replication_factor

The correct answer is: site_mappings

When decommissioning a site in an indexer cluster, adding the site_mappings attribute to the master node's server.conf file is crucial. The site_mappings attribute is specifically used to define how data is distributed across different sites within the cluster. By updating this attribute, you inform the cluster about the changes in site configurations and data management practices. This adjustment ensures that the master node can appropriately recognize and coordinate the remaining sites and their related characteristics, such as data replication and search factors. This change is essential for maintaining the integrity and performance of the indexer cluster, especially when certain sites are no longer part of the operational architecture. Proper handling of the site mappings helps avoid potential data loss or inconsistencies that could arise from the sudden unavailability of a site. The other attributes mentioned serve different purposes. For instance, available_sites relates to the sites currently enabled for data storage or searching, whereas site_search_factor and site_replication_factor set the parameters for how many copies of data are stored and searched in the cluster, respectively. These attributes do play an important role within the overall cluster management but are not the correct ones to update when directly addressing the decommissioning of a site.