A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

A multi-site indexer cluster is configured on the manager node. This can be done by directly editing the server.conf file to add the [multisite] stanza and define site-specific attributes. Alternatively, the splunk edit cluster-config command-line interface (CLI) tool can be used to modify these same settings. Splunk Web is used for monitoring the cluster's status and performing some management tasks, but not for the initial multi-site setup. Editing default configuration files is against Splunk best practices.

A. Splunk Web is used for monitoring and managing an already configured cluster, not for the initial multi-site architectural setup.

D. The default directory contains template files. You should never edit files in this directory as they can be overwritten during upgrades.

- Splunk Enterprise Documentation, Managing Indexers and Clusters of Indexers, "Configure a multisite indexer cluster", Section: "Enable multisite on the manager node". This section details using both the CLI and server.conf for configuration.

- Splunk Enterprise Documentation, Admin Manual, "server.conf". This specification file documents the [multisite] and [clustering] stanzas required for this configuration.