Exam SPLK-3003 topic 1 question 17 discussion

Depends on whether the rolled index is the primary. If yes, then B. But if not, then D.

Slide 365 of Core Implementation I think that a replicated copy can be searchable and non-searchable depending on the SF/RF settings. We assume there is another searchable copy in the cluster. The SF may be = 1, but not very likely. The last line says: "The only caveat to this is if one of the remaining copies is a searchable copy (and we froze the primary); in this instance, an already-existing searchable copy can be flagged primary (searchable)." I think it's "B"

B. first of all what happens: "[...]The manager then stops doing fix-ups on that bucket. It operates under the assumption that the other peers will eventually freeze their copies of that bucket as well." but(!!) then it will also do this: "In 6.3 and later, when a primary copy freezes, the cluster reassigns the primary to another searchable copy, if one exists. Searching then continues on that bucket with the new primary copy. When that primary also freezes, the cluster attempts to reassign the primary yet again to another searchable copy. Once all searchable copies of the bucket have been frozen, searching ceases on that bucket." so overall B is the most correct answer here. ref: https://docs.splunk.com/Documentation/Splunk/9.1.3/Indexer/Bucketsandclusters#How_the_cluster_handles_frozen_buckets

Slide 365 of Core Implementation

its D. B is a replicated copy and is not searchable. From the bootcamp slidedeck notes: Individual hosts manage their own retention, but notify master. May trigger fixup activity. One host may have frozen a bucket (perhaps because of uneven disk usage) but others may still have a live copy. If this other copy is live, then the bucket will remain searchable. If only replica copies are available, the data will no longer be searchable. Any bucket frozen in a cluster is only frozen *on that instance*, however, the peer will notify the CM. This is so that no fixup activity is done for that bucket any longer. That is, if a bucket is “missing” because it was frozen, it won’t be replaced. The assumption is that the other indexers will freeze it themselves relatively soon. The only caveat to this is if one of the remaining copies is a searchable copy (and we froze the primary); in this instance, an already-existing searchable copy can be flagged primary (searchable).

https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Bucketsandclusters Note: In 6.3, a change was made in how the cluster responds to frozen primary bucket copies, in order to prolong the time that a bucket remains available for searching: In a pre-6.3 cluster, when a primary copy freezes, the cluster does not attempt to reassign the primary to any other remaining searchable copy. Searching on a bucket ceases once the primary is frozen. In 6.3 and later, when a primary copy freezes, the cluster reassigns the primary to another searchable copy, if one exists. Searching then continues on that bucket with the new primary copy. When that primary also freezes, the cluster attempts to reassign the primary yet again to another searchable copy. Once all searchable copies of the bucket have been frozen, searching ceases on that bucket.

Answer B: Verified by ChatGPT.

I think that B is a better answer. It's basically the same as D, with the addition of the point about primary buckets. And that is exactly what happens if the frozen bucket happens to be primary and there happens to be a replicated bucket that is searchable. The question doesn't specifically say the frozen bucket is primary, but that doesn't mean we should ignore the possibility. Answer B is more complete than D.

I would say also that D is the correct one. We do not talk about primary bucket.

D is the correct, if in the question speak about primary bucket, would be B, but it is not the case

Answer D. Source - page 365 of "Services Core Implementation.pdf"

D is correct answer.

B is correct when a primary copy freezes, the cluster reassigns the primary to another searchable copy, if one exists. Searching then continues on that bucket with the new primary copy. When that primary also freezes, the cluster attempts to reassign the primary yet again to another searchable copy. Once all searchable copies of the bucket have been frozen, searching ceases on that bucket.