What component stops indexing and replicating during manual failure modes?

The component that stops indexing and replicating during manual failure modes is the Indexer. The Indexer is responsible for processing incoming data, indexing it, and making it searchable within Splunk. When a failure occurs that necessitates manual intervention, the Indexer will pause its activities to prevent further issues, such as data corruption or partial indexing of data, while administrators address the problem.

In the context of Splunk's architecture, the Cluster Master, which manages the replication and distribution of indexed data among Indexers in a cluster, does not directly handle the indexing process; hence, it also does not stop indexing during manual failures. The Search Head is primarily involved in querying the data and does not participate in the indexing process itself. The option indicating that all components stop indexing and replicating is incorrect since only the Indexer is directly related to the indexing activity and responds to manual failures in this way.