To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

In a search-head cluster the scheduler skips any member flagged as an “adhoc” search head.

Setting captainisadhocsearchhead = true in the [shclustering] stanza of server.conf on the captain causes the captain itself to be treated as an adhoc search head, so it will not be assigned scheduled searches. All user-initiated (ad-hoc) searches can still run, but the scheduler load is removed from the captain, reducing its workload.

A. adhocsearchhead affects only the local member and is ignored by the captain scheduler; it does not single out the captain.

B. Same parameter as A but limited to the current captain; still not the correct directive for excluding scheduled searches.

C. Setting captainisadhocsearchhead on every member is unnecessary; only the node that is captain must have it set.

1. Splunk Enterprise server.conf.spec, [shclustering] – “captainisadhocsearchhead = … When true the captain is treated as an adhoc search head and will not run scheduled searches.” (etc/system/README/server.conf.spec, Splunk 9.0.4).

2. Splunk Enterprise Distributed Search Manual 9.0, “Prevent the captain from running scheduled searches”, para 1-2.