QUESTION: 25

The customer wants to migrate their current Splunk Index cluster to new hardware to improve indexing and search performance. What is the correct process and procedure for this task?

1. Install new indexers.
2. Configure indexers into the cluster as peers; ensure they receive the same configuration via the deployment server.
3. Decommission old peers one at a time.
4. Remove old peers from the CM’s list.
5. Update forwarders to forward to the new peers.
1. Install new indexers.
2. Configure indexers into the cluster as peers; ensure they receive the cluster bundle and the same configuration as original peers.
3. Decommission old peers one at a time.
4. Remove old peers from the CM’s list.
5. Update forwarders to forward to the new peers.
1. Install new indexers.
2. Configure indexers into the cluster as peers; ensure they receive the same configuration via the deployment server.
3. Update forwarders to forward to the new peers.
4. Decommission old peers on at a time.
5. Restart the cluster master (CM).
1. Install new indexers.
2. Configure indexers into the cluster as peers; ensure they receive the cluster bundle and the same configuration as original peers.
3. Update forwarders to forward to the new peers.
4. Decommission old peers one at a time.
5. Remove old peers from the CM’s list.

Answer(s): C

Reveal Solution Next Question

Consider the scenario where the /var/log directory contains the files secure, messages, cron, audit. A customer has created the following inputs.conf stanzas in the same Splunk app in order to attempt to monitor the files secure and messages:

Which file(s) will actually be actively monitored?