Splunk documentation states that in an indexer-clustered environment, the Monitoring Console should be deployed on the Cluster Manager. This placement ensures direct access to cluster-wide metrics, replication status, bucket health, and indexer performance data.
The Cluster Manager already communicates with all peer indexers and maintains authoritative cluster state information. Hosting the Monitoring Console on this instance allows it to automatically collect and display cluster health dashboards without requiring additional configuration.
While the Monitoring Console can technically run on other instances, Splunk explicitly recommends colocating it with the Cluster Manager in clustered deployments to ensure full visibility and accuracy.
Deploying it on each instance or on unrelated servers is not recommended and does not align with Splunk best practices.
Therefore, the correct answer is D: On the Cluster Manager.
References:
Splunk Monitoring Console Manual; Indexer Cluster Management Guide; Cluster Health Monitoring Best Practices.