According to the Splunk documentation1, any search head in the cluster can update the KV store collection.
The KV store collection is replicated across all the cluster members, and any write operation is delegated to the KV store captain, who then synchronizes the changes with the other members. The KV store primary search head is not a valid term, as there is no such role in a search head cluster. The other options are false because:
* The search head cluster captain is not the only node that can update the KV store collection, as any member can initiate a write operation1.
* Any search head except the captain can also update the KV store collection, as the write operation will be delegated to the captain1.