IBM Security Systems C1000-156 Question # 9 Topic 1 Discussion
C1000-156 Exam Topic 1 Question 9 Discussion:
Question #: 9
Topic #: 1
An administrator would like to optimize event and flow payload searches for log data that is stored for up to a month. What does an administrator need to do to achieve that requirement?
A.
Perform a clean on the search model.
B.
Configure the retention period for property indexes.
C.
Configure the retention period for payload indexes.
D.
Configure the retention period for search indexes.
To optimize event and flow payload searches for log data stored for up to a month, an administrator should configure the retention period for payload indexes. Here’s the process:
Retention Period Configuration: Set the retention period for payload indexes to match the desired data storage duration (e.g., one month).
Improved Search Efficiency: By configuring the retention period appropriately, QRadar ensures that the indexed data is efficiently searchable, improving performance during searches.
Index Management: Regularly manage and clean up indexes to maintain optimal system performance and storage utilization.
ReferencesThe IBM QRadar SIEM administration guides provide instructions on configuring retention periods for various types of indexes, including payload indexes, to optimize search performance.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit