Pre-Summer Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: validbest

Exam SPLK-3001 All Questions
Exam SPLK-3001 All Questions

View all questions & answers for the SPLK-3001 exam

Splunk Enterprise Security Certified Admin SPLK-3001 Question # 21 Topic 3 Discussion

SPLK-3001 Exam Topic 3 Question 21 Discussion:
Question #: 21
Topic #: 3

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.

Which of the following options is most likely to help performance?


A.

Change the search heads to do local indexing of summary searches.


B.

Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.


C.

Increase memory and CPUs on the search head(s) and add additional indexers.


D.

If indexed realtime search is enabled, disable it for the notable index.


Get Premium SPLK-3001 Questions

Contribute your Thoughts:


Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.