nerdexam
Splunk

SPLK-3003 · Question #16

An index receives approximately 50GB of data per day per indexer at an even and consistent rate. The customer would like to keep this data searchable for a minimum of 30 days. In addition, they have…

The correct answer is A. frozenTimePeriodInSecs, maxDataSize, maxVolumeDataSizeMB, maxHotBuckets. Option A is correct because it covers all four dimensions the scenario demands: frozenTimePeriodInSecs enforces the 30-day time-based retention requirement; maxDataSize controls hot bucket sizing for a consistent 50 GB/day ingest rate; maxVolumeDataSizeMB caps total disk…

Search Performance and Optimization

Question

An index receives approximately 50GB of data per day per indexer at an even and consistent rate. The customer would like to keep this data searchable for a minimum of 30 days. In addition, they have hourly scheduled searches that process a week's worth of data and are quite sensitive to search performance. Given ideal conditions (no restarts, nor drops/bursts in data volume), and following PS best practices, which of the following sets of indexes.conf settings can be leveraged to meet the requirements?

Options

  • AfrozenTimePeriodInSecs, maxDataSize, maxVolumeDataSizeMB, maxHotBuckets
  • BmaxDataSize, maxTotalDataSizeMB, maxHotBuckets, maxGlobalDataSizeMB
  • CmaxDataSize, frozenTimePeriodInSecs, maxVolumeDataSizeMB
  • DfrozenTimePeriodInSecs, maxWarmDBCount, homePath.maxDataSizeMB, maxHotSpanSecs

How the community answered

(61 responses)
  • A
    62% (38)
  • B
    21% (13)
  • C
    5% (3)
  • D
    11% (7)

Explanation

Option A is correct because it covers all four dimensions the scenario demands: frozenTimePeriodInSecs enforces the 30-day time-based retention requirement; maxDataSize controls hot bucket sizing for a consistent 50 GB/day ingest rate; maxVolumeDataSizeMB caps total disk consumption at the volume level (PS best practice over per-index size limits); and maxHotBuckets tunes parallelism to protect the search performance of those weekly, hourly scheduled jobs.

B is wrong because maxTotalDataSizeMB is size-based, not time-based - without frozenTimePeriodInSecs, data can be frozen before 30 days are reached if the size cap is hit, and maxGlobalDataSizeMB is a redundant volume setting that duplicates maxVolumeDataSizeMB rather than replacing it. C is wrong because it omits maxHotBuckets, which is the primary lever for improving search concurrency and performance against the week's worth of data those scheduled searches touch. D is wrong because maxWarmDBCount and homePath.maxDataSizeMB are legacy or path-specific settings that PS best practices discourage in favour of volume-level controls, and maxHotSpanSecs controls bucket time span rather than data retention duration - it does not substitute for frozenTimePeriodInSecs.

Memory tip: Think of the acronym F-M-M-H - Frozen time (retention), Max data size (bucket size), Max volume (disk cap), Hot buckets (search performance) - these four settings form the complete toolkit for a well-balanced, PS-compliant index configuration.

Topics

#indexes.conf#frozenTimePeriodInSecs#maxVolumeDataSizeMB#maxHotBuckets

Community Discussion

No community discussion yet for this question.

Full SPLK-3003 Practice