Splunk
SPLK-3001 · Question #33
Which of the following actions can improve overall search performance?
The correct answer is C. Reduce the frequency (schedule) of lower-priority correlation searches. This reduces the load on the system by ensuring that less critical searches are not run as often, freeing up resources for higher-priority tasks and improving overall search performance.
Troubleshooting and Optimization
Question
Which of the following actions can improve overall search performance?
Options
- ADisable indexed real-time search.
- BIncrease priority of all correlation searches.
- CReduce the frequency (schedule) of lower-priority correlation searches.
- DAdd notable event suppressions for correlation searches with high numbers of false positives.
How the community answered
(30 responses)- A7% (2)
- B3% (1)
- C77% (23)
- D13% (4)
Explanation
This reduces the load on the system by ensuring that less critical searches are not run as often, freeing up resources for higher-priority tasks and improving overall search performance.
Topics
#search performance#scheduling optimization#correlation search tuning
Community Discussion
No community discussion yet for this question.