When adding a new search head to a search head cluster (SHC), which of the...

When adding a new search head to a search head cluster (SHC), the following scenario occurs:

The new search head connects to the deployer and pulls the most recently deployed bundle. The deployer is a Splunk instance that manages the app configuration bundle for the SHC. The bundle contains the app configurations and knowledge objects that are common to all the search heads in the cluster. The new search head downloads and extracts the bundle to its etc/shcluster/apps directory.

The new search head connects to the captain and replays any recent configuration changes to bring it up to date. The captain is one of the search heads in the cluster that coordinates the cluster activities and maintains the cluster state. The captain keeps track of any configuration changes that are made on any of the cluster members, such as creating or modifying dashboards, reports, alerts, or macros. The new search head requests these changes from the captain and applies them to its own configuration.

By following these steps, the new search head synchronizes its configuration with the rest of the cluster and becomes a fully functional member.

References:

Splunk Core Certified Consultant Test Blueprint

Splunk Documentation: Add a new member to a search head cluster

Splunk Documentation: Deploy apps across a search head cluster

Splunk Documentation: How a search head cluster works