Splunk
SPLK-3003 · Question #56
A customer has three users and is planning to ingest 250GB of data per day. They are concerned with search uptime, can tolerate up to a two-hour downtime for the search tier, and want advice on…
The correct answer is D. The customer should deploy a single search head with a warm standby search head and an rsync. https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Summaryofperformancerecomme
Splunk Architecture and Deployment Best Practices
Question
A customer has three users and is planning to ingest 250GB of data per day. They are concerned with search uptime, can tolerate up to a two-hour downtime for the search tier, and want advice on single search head versus a search head cluster. (SHC). Which recommendation is the most appropriate?
Options
- AThe customer should deploy two active search heads behind a load balancer to support HA.
- BThe customer should deploy a SHC with a single member for HA; more members can be added
- CThe customer should deploy a SHC, because it will be required to support the high volume of data.
- DThe customer should deploy a single search head with a warm standby search head and an rsync
How the community answered
(37 responses)- A22% (8)
- B5% (2)
- C11% (4)
- D62% (23)
Explanation
https://docs.splunk.com/Documentation/Splunk/latest/Capacity/Summaryofperformancerecomme
Topics
#search head cluster#high availability#warm standby#search head sizing
Community Discussion
No community discussion yet for this question.