Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Question

Options

• AIncreasing the search factor in the cluster.
• BIncreasing the replication factor in the cluster.
• CIncreasing the number of search heads in the cluster.
• DIncreasing the number of CPUs on the indexers in the cluster.

• A
  87% (26)
• B
  7% (2)
• C
  3% (1)
• D
  3% (1)

Explanation

Increasing the search factor in the cluster will best address the requirement of high availability for searchable data. The search factor determines how many copies of searchable data are maintained by the cluster. A higher search factor means that more indexers can serve the data in case of a failure or a maintenance event. Increasing the replication factor will improve the availability of raw data, but not searchable data. Increasing the number of search heads or CPUs on the indexers will improve the search performance, but not the availability of searchable data. For more information, see Replication factor and search factor in the Splunk documentation.

No community discussion yet for this question.