A Splunk environment collecting 10 TB of data per day has 50 indexers and 5 search heads. A single- site indexer cluster will be implemented. Which of the following is a best practice for added data…

Question

Options

• ASet the Replication Factor to 49.
• BSet the Replication Factor based on allowed indexer failure.
• CAlways use the default Replication Factor of 3.
• DSet the Replication Factor based on allowed search head failure.

• A
  9% (2)
• B
  74% (17)
• C
  13% (3)
• D
  4% (1)

Explanation

The correct answer is B. Set the Replication Factor based on allowed indexer failure. This is a best practice for adding data resiliency to a single-site indexer cluster, as it ensures that there are enough copies of each bucket to survive the loss of one or more indexers without affecting the searchability of the data1. The Replication Factor is the number of copies of each bucket that the cluster maintains across the set of peer nodes2. The Replication Factor should be set according to the number of indexers that can fail without compromising the cluster's ability to serve data1. For example, if the cluster can tolerate the loss of two indexers, the Replication Factor should be set to three1. The other options are not best practices for adding data resiliency. Option A, setting the Replication Factor to 49, is not recommended, as it would create too many copies of each bucket and consume excessive disk space and network bandwidth1. Option C, always using the default Replication Factor of 3, is not optimal, as it may not match the customer's requirements and expectations for data availability and performance1. Option D, setting the Replication Factor based on allowed search head searchability of the data on the indexers1. Therefore, option B is the correct answer, and options A, C, and D are incorrect. 1: Configure the replication factor 2: About indexer clusters and index replication

No community discussion yet for this question.