Splunk Enterprise Certified Architect Practice Test

A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?

1. splunk add cluster-config

2. splunk add cluster-master

3. splunk edit cluster-config

4. splunk edit cluster-master

The correct answer is: splunk add cluster-master

The command used to configure a search head to join another indexer cluster is "splunk add cluster-master." This command is specifically designed for adding a search head to a different indexer cluster by specifying the cluster master responsible for that cluster. When you use this command, it allows the search head to communicate with the new cluster's indexers and participate in searching through the data that resides in that cluster. This is particularly important when dealing with multiple indexer clusters, as each cluster has its own configuration and search head requirements. In contrast, the other commands have different functionalities that are not appropriate for joining a new indexer cluster. For instance, "splunk add cluster-config" is utilized for initially adding cluster configurations, which does not specifically address the requirement of connecting to another indexer cluster. Similarly, "splunk edit cluster-config" modifies existing cluster settings rather than adding a new connection. Lastly, "splunk edit cluster-master" is used to change the configuration of an already defined cluster master, which would not result in joining a new indexer cluster.