Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

Question

Options

• ASetting the cluster search factor to N-1.
• BIncreasing the number of buckets per index.
• CDecreasing the data model acceleration range.
• DSetting the cluster replication factor to N-1.

• A
  4% (1)
• B
  4% (1)
• C
  83% (19)
• D
  9% (2)

Explanation

Decreasing the data model acceleration range will reduce the disk size requirements for a cluster of indexers running Splunk Enterprise Security. Data model acceleration creates tsidx files that consume disk space on the indexers. Reducing the acceleration range will limit the amount of data that is accelerated and thus save disk space. Setting the cluster search factor or replication factor to N-1 will not reduce the disk size requirements, but rather increase the risk of data loss. Increasing the number of buckets per index will also increase the disk size requirements, as each bucket has a minimum size. For more information, see Data model acceleration and Bucket size in the Splunk

No community discussion yet for this question.