Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

• A.Setting the cluster search factor to N-1.
• B.Increasing the number of buckets per index.
• C.Decreasing the data model acceleration range.
• D.Setting the cluster replication factor to N-1.

Comment: *

Name: *

Email: *

Verification: *

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

• A.Two indexers clustered, assuming a high volume of saved/scheduled searches.
• B.Two indexers not in a cluster, assuming users run many long searches.
• C.Three indexers not in a cluster, assuming a long data retention period.
• D.Two indexers clustered, assuming high availability is the greatest priority.

Comment: *

Name: *

Email: *

Verification: *

Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

• A.System local directory.
• B.System default directory.
• C.App local directories, in ASCII order.
• D.App default directories, in ASCII order.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is a way to exclude search artifacts when creating a diag?

• A.SPLUNK_HOME/bin/splunk diag --debug --refresh
• B.SPLUNK_HOME/bin/splunk diag --exclude
• C.SPLUNK_HOME/bin/splunk diag --filter-searchstrings
• D.SPLUNK_HOME/bin/splunk diag --disable=dispatch

Comment: *

Name: *

Email: *

Verification: *

Which server.confattribute should be added to the master node's server.conffile when
decommissioning a site in an indexer cluster?

• A.site_mappings
• B.available_sites
• C.site_search_factor
• D.site_replication_factor

Comment: *

Name: *

Email: *

Verification: *