Which of the following statements describe search head clustering? (Select all that apply.)

• A.The deployer must have sufficient CPU and network resources to process service requests and push configurations.
• B.A deployer is required.
• C.Search heads must meet the high-performance reference server requirements.
• D.At least three search heads are needed.

Comment: *

Name: *

Email: *

Verification: *

Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

• A.Virtualized environments are usually preferred over bare metal for Splunk indexers.
• B.High performance SAN should never be used.
• C.The recommended RAID setup is RAID 10 (1 + 0).
• D.Enable NFS for storing hot and warm buckets.

Comment: *

Name: *

Email: *

Verification: *

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

• A.adhoc_searchhead = true (on all members)
• B.adhoc_searchhead = true (on the current captain)
• C.captain_is_adhoc_searchhead = true (on all members)
• D.captain_is_adhoc_searchhead = true (on the current captain)

Comment: *

Name: *

Email: *

Verification: *

The frequency in which a deployment client contacts the deployment server is controlled by what?

• A.polling_interval attribute in outputs.conf
• B.phoneHomeIntervalInSecs attribute in outputs.conf
• C.polling_interval attribute in deploymentclient.conf
• D.phoneHomeIntervalInSecs attribute in deploymentclient.conf

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

• A.Is the job scheduler for the entire SHC.
• B.Manages alert action suppressions (throttling).
• C.Synchronizes the member list with the KV store primary.
• D.Replicates the SHC's knowledge bundle to the search peers.

Comment: *

Name: *

Email: *

Verification: *