Splunk
SPLK-3001 · Question #45
SPLK-3001 Question #45: Real Exam Question with Answer & Explanation
The correct answer is C. Increase memory and CPUs on the search head(s) and add additional indexers.. See the full explanation below for the reasoning.
Question
A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives. Which of the following options is most likely to help performance?
Options
- AChange the search heads to do local indexing of summary searches.
- BAdd heavy forwarders between the universal forwarders and indexers so inputs can be parsed
- CIncrease memory and CPUs on the search head(s) and add additional indexers.
- DIf indexed realtime search is enabled, disable it for the notable index.
Community Discussion
No community discussion yet for this question.