Which Splunk cluster feature requires additional indexer storage?

Question

Options

• ASearch Head Clustering
• BIndexer Discovery
• CIndexer Acknowledgement
• DIndex Summarization

• A
  6% (2)
• B
  3% (1)
• C
  13% (4)
• D
  78% (25)

Explanation

Splunk's documentation on summary indexing and data-model acceleration clarifies that summary data is stored as additional indexed data on the indexers. Summary indexing produces new events- aggregations, rollups, scheduled search outputs-and stores them in summary indexes. Splunk explains that these summaries accumulate over time and require additional bucket storage, retention considerations, and sizing adjustments. The documentation for accelerated data models further confirms that acceleration summaries are stored alongside raw data on indexers, increasing disk usage proportional to the acceleration workload. This makes summary indexing the only listed feature that strictly increases indexer storage In contrast, Search Head Clustering replicates configuration and knowledge objects across search heads-not on indexers. Indexer Discovery affects forwarder behavior, not storage. Indexer Acknowledgement controls data-delivery guarantees but does not create extra indexed content. Therefore, only Index Summarization (summary indexing) directly increases indexer storage Splunk Summary Indexing Documentation; Splunk Data Model Acceleration Guidelines; Splunk Storage and Capacity Planning Documentation.

No community discussion yet for this question.