When are knowledge bundles distributed to search peers?

When are knowledge bundles distributed to search peers?
A . After a user logs in.
B . When Splunk is restarted.
C . When adding a new search peer.
D . When a distributed search is initiated.

View Answer

Answer: D

Explanation:

"The search head replicates the knowledge bundle periodically in the background or when initiating a search. " "As part of the distributed search process, the search head replicates and distributes its knowledge objects to its search peers, or indexers. Knowledge objects include saved searches, event types, and other entities used in searching accorss indexes. The search head needs to distribute this material to its search peers so that they can properly execute queries on its behalf."

Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Whatsearchheadssend