Which of the following strongly impacts storage sizing requirements for Enterprise Security?

Question

Options

• AThe number of scheduled (correlation) searches.
• BThe number of Splunk users configured.
• CThe number of source types used in the environment.
• DThe number of Data Models accelerated.

• A
  7% (2)
• B
  3% (1)
• C
  14% (4)
• D
  76% (22)

Explanation

Data Model acceleration is a feature that enables faster searches over large data sets by summarizing the raw data into a more efficient format. Data Model acceleration consumes additional disk space, as it stores both the raw data and the summarized data. The amount of disk space required depends on the size and complexity of the Data Model, the retention period of the summarized data, and the compression ratio of the data. According to the Splunk Enterprise Security Planning and Installation Manual, Data Model acceleration is one of the factors that strongly impacts storage sizing requirements for Enterprise Security. The other factors are the volume and type of data sources, the retention policy of the data, and the replication factor and search factor of the index cluster. The number of scheduled (correlation) searches, the number of Splunk users configured, and the number of source types used in the environment are not directly related to storage sizing requirements for Enterprise Security1 1: https://docs.splunk.com/Documentation/ES/6.6.0/Install/Plan#Storage_sizing_requirements

No community discussion yet for this question.