A customer has the following Splunk instances within their environment: An indexer cluster consisting of a cluster master/master node and five…

The Monitoring Console (MC) functions as a dedicated search head to monitor the health and performance of a Splunk environment. To gather data, it must be configured to search all other Splunk instances. In a distributed deployment, this is achieved by adding the instances as search peers. For an indexer cluster, only the cluster master node is added as a search peer to the MC. The cluster master then manages and forwards search requests to the indexer peers. All other single-purpose instances, including standalone search heads, the deployment server, and the license master, must be added individually as search peers to the MC.

A. This is incorrect because it omits the search heads, deployment server, and license master, which are critical components that also require monitoring.

B. This is incorrect because individual indexers within a cluster are not added as search peers. The cluster master manages search coordination for the entire cluster.

D. This is incorrect as it fails to include the search heads and the entire indexer cluster (represented by the cluster master) for comprehensive monitoring.

1. Splunk Enterprise Documentation, Monitoring Splunk Enterprise, Version 9.2.1, "Set up the monitoring console in a distributed deployment". The section "Add instances as search peers" states: "Add all instances in your deployment as search peers to the monitoring console, except for the indexer peers in an indexer cluster. For an indexer cluster, you add the cluster manager node as a search peer." This directly supports adding the cluster master, search heads, deployment server, and license master, while excluding the individual indexers.

2. Splunk Enterprise Documentation, Distributed Search, Version 9.2.1, "How search heads interact with indexer clusters". This section clarifies the search relationship: "To enable a search head to search an indexer cluster, you must configure the cluster master as a search peer on the search head." The Monitoring Console acts as a search head in this context.