Which of the following is true regarding Splunk Enterprise's performance? (Select all that apply.)

Question

Options

• AAdding search peers increases the maximum size of search results.
• BAdding RAM to existing search heads provides additional search capacity.
• CAdding search peers increases the search throughput as the search load increases.
• DAdding search heads provides additional CPU cores to run more concurrent searches.

Explanation

The correct answers are C and D.

C is correct because search peers (indexers) are responsible for searching raw data in parallel. Adding more search peers distributes the search workload across more nodes, directly increasing throughput - especially under heavy load when many searches compete for resources simultaneously.

D is correct because search heads execute SPL commands, manage jobs, and handle concurrency. Each search head contributes its own CPU cores, so adding more search heads scales horizontal capacity for concurrent users and searches.

Why the distractors fail:

• A is wrong - The maximum size of search results is governed by configuration settings (e.g., maxresultrows), not by the number of search peers. More peers mean faster searching, not bigger result sets.
• B is wrong - Adding RAM to existing search heads improves memory-intensive operations but doesn't meaningfully expand search capacity (concurrency). True capacity scaling requires adding more search head nodes, not just more RAM to existing ones.

Memory tip: Think of search peers as the "workers in the warehouse" (more workers = faster retrieval) and search heads as "managers" (more managers = more simultaneous projects). RAM is like giving a manager a bigger desk - helpful, but doesn't add a new manager.

No community discussion yet for this question.