To reduce the captain’s work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

To reduce the captain’s work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?
A . adhoc_searchhead = true (on all members)
B . adhoc_searchhead = true (on the current captain)
C . captain_is_adhoc_searchhead = true (on all members)
D . captain_is_adhoc_searchhead = true (on the current captain)

View Answer

Answer: D

Explanation:

To reduce the captain’s work load in a search head cluster, the setting that will prevent scheduled searches from running on the captain is captain_is_adhoc_searchhead = true (on the current captain). This setting will designate the current captain as an ad hoc search head, which means that it

will not run any scheduled searches, but only ad hoc searches initiated by users. This will reduce the captain’s work load and improve the search head cluster performance. The adhoc_searchhead = true (on all members) setting will designate all search head cluster members as ad hoc search heads, which means that none of them will run any scheduled searches, which is not desirable. The adhoc_searchhead = true (on the current captain) setting will have no effect, as this setting is ignored by the captain. The captain_is_adhoc_searchhead = true (on all members) setting will have no effect, as this setting is only applied to the current captain. For more information, see Configure the captain as an ad hoc search head in the Splunk documentation.