nerdexam
Splunk

SPLK-3001 · Question #45

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicatin

Sign in or unlock SPLK-3001 to reveal the answer and full explanation for question #45. The question stem and answer options stay visible for context.

Troubleshooting and Optimization

Question

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives. Which of the following options is most likely to help performance?

Options

  • AChange the search heads to do local indexing of summary searches.
  • BAdd heavy forwarders between the universal forwarders and indexers so inputs can be parsed
  • CIncrease memory and CPUs on the search head(s) and add additional indexers.
  • DIf indexed realtime search is enabled, disable it for the notable index.

Unlock SPLK-3001 to see the answer

You've previewed enough free SPLK-3001 questions. Unlock SPLK-3001 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.

Topics

#performance tuning#search head#correlation searches#concurrent searches
Full SPLK-3001 Practice