Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

• A.Synchronizes the member list with the KV store primary.
• B.Replicates the SHC's knowledge bundle to the search peers.
• C.Is the job scheduler for the entire SHC.
• D.Manages alert action suppressions (throttling).

Comment: *

Name: *

Email: *

Verification: *

Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

• A.Add more search peers and make sure forwarders distribute data evenly across all indexers.
• B.Look for slow searches and reschedule them to run during an off-peak time.
• C.Replace the indexer storage to solid state drives (SSD).
• D.Add more search heads and redistribute users based on the search type.

Comment: *

Name: *

Email: *

Verification: *

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

• A.Three indexers not in a cluster, assuming a long data retention period.
• B.Two indexers clustered, assuming high availability is the greatest priority.
• C.Two indexers clustered, assuming a high volume of saved/scheduled searches.
• D.Two indexers not in a cluster, assuming users run many long searches.

Comment: *

Name: *

Email: *

Verification: *

When should a Universal Forwarder be used instead of a Heavy Forwarder?

• A.When most of the data requires masking.
• B.When there is a high-velocity data source.
• C.When data comes directly from a database server.
• D.When a modular input is needed.

Comment: *

Name: *

Email: *

Verification: *

Where in the Job Inspector can details be found to help determine where performance is affected?

• A.Search Job Properties > runDuration
• B.Search Job Properties > runtime
• C.Job Details Dashboard > Total Events Matched
• D.Execution Costs > Components

Comment: *

Name: *

Email: *

Verification: *