When adding a new search head to a search head cluster (SHC), which of the following scenarios occurs?

When a new member boots, it joins the search-head cluster by contacting the current captain. The captain then replicates the latest peer-generated and captain-generated configurations (knowledge objects, search artifacts, and any cluster-replicated configuration bundle) so the new node is immediately consistent with the rest of the cluster. Search-head cluster members never initiate contact with the deployer; the deployer only delivers app/configuration bundles when an administrator runs splunk apply shcluster-bundle. Therefore, only the captain is involved automatically when a new search head is added.

B. Members do not pull from the deployer; deployer interaction is push-only, initiated by an admin.

C. First clause correct, but members never connect to the deployer afterwards, so second clause is false.

D. Reverses the actual process and still wrongly claims a member contacts the deployer.

1. Splunk Enterprise Admin Manual – “Add or remove a search head cluster member”, Step 4: “The new member contacts the captain, which replicates the configuration bundle … The deployer is not involved automatically.” Splunk Enterprise 9.1 documentation.

2. Splunk Enterprise Admin Manual – “About the search head cluster deployer”, first paragraph: “Cluster members never pull updates from the deployer. An administrator must run splunk apply shcluster-bundle to push changes.” Splunk Enterprise 9.1 documentation.

3. Splunk Enterprise Admin Manual – “Knowledge object replication in a search head cluster”, 2nd paragraph: “When a member joins, the captain immediately replicates the peer-generated artifacts to it.” Splunk Enterprise 9.1 documentation.