A site from a multi-site indexer cluster needs to be decommissioned. Which of the following actions must be taken?

Decommissioning a site in a Splunk multi-site indexer cluster is a two-fold process. First, the cluster manager must be informed that the site is no longer available. This is accomplished by removing the site's configuration stanza from the server.conf file on the manager node. Second, the data ingestion path must be updated. Forwarders that were configured to send data to the peers in the decommissioned site must be reconfigured to send data to peers in the remaining active sites. This ensures both cluster stability and the continuity of data flow. Option D correctly identifies both of these essential actions.

A. Nothing. Decommissioning a site is not possible.

This is incorrect. Splunk Enterprise provides a documented procedure for permanently decommissioning a site from a multi-site indexer cluster to allow for infrastructure changes.

B. Create an alias for where the new data should be sent.

This action is incomplete. While redirecting forwarders is a necessary step, failing to remove the site from the cluster manager's configuration will cause cluster instability and errors.

C. Remove the site from the list of available sites.

This action is also incomplete. Although it correctly updates the cluster's state, it fails to address the forwarders that are still attempting to send data to the now-nonexistent site.

1. Splunk Documentation, Managing Indexers and Clusters of Indexers, "Decommission a site".

Section: Decommission a site

Content Reference: The documentation explicitly outlines the required steps: "2. On the manager node, remove the site from the list of available sites... 3. Handle the forwarders. You must reconfigure any forwarders that were sending data to the decommissioned site's peers." This directly supports the combined actions described in answer D.