Which of the following statements applies to indexer discovery?

Indexer discovery is a specific feature in Splunk indexer clustering designed for forwarders. It allows forwarders to automatically learn the set of active peer nodes (indexers) by querying the Cluster Master (CM). The forwarder is configured with the CM's address, and it periodically fetches the list of indexers to which it can send data. This mechanism enables forwarders to load balance data across all available indexers and adapt dynamically as indexers are added to or removed from the cluster, without needing manual reconfiguration on the forwarder itself.

A. The Cluster Master (CM) can automatically discover new indexers added to the cluster.

Incorrect. The Cluster Master does not discover indexers; indexers are explicitly configured with the master's URI and actively register themselves with it.

C. Deployment servers can automatically configure new indexers added to the cluster.

Incorrect. A deployment server is a separate management component for distributing configurations; it does not perform the client-side discovery function characteristic of indexer discovery.

D. Search heads can automatically discover new indexers added to the cluster.

Incorrect. While search heads also query the CM for a list of peers to search, the specific feature named "indexer discovery" in official documentation refers to the process for forwarders.

---

1. Splunk Enterprise Documentation, Managing Indexers and Clusters of Indexers, "Use indexer discovery to connect forwarders to peer nodes."

This section explicitly states, "Indexer discovery is a feature that allows forwarders to automatically discover the set of peer nodes in an indexer cluster... With indexer discovery, you configure the forwarders to get the list of peer nodes from the cluster master." This directly supports answer B as the primary definition of the feature.

2. Splunk Enterprise Documentation, Managing Indexers and Clusters of Indexers, "Connect the search heads to the peer nodes."

This section describes the process for search heads: "To enable the search heads to search across the set of peer nodes, you must configure each search head as a search peer of the cluster. You do this by pointing the search head to the cluster master." This confirms that while the mechanism is similar, the official terminology "indexer discovery" is reserved for the forwarder use case, making option D incorrect in the context of the named feature.

3. Splunk Enterprise Documentation, Managing Indexers and Clusters of Indexers, "Indexer cluster components."

This section details the role of the Cluster Master and peer nodes. It clarifies that peer nodes are configured to contact the master, stating, "You specify the master's location... in each peer's server.conf file." This contradicts the idea that the master "discovers" the peers (option A).