A Splunk deployment is being architected and the customer will be using Splunk Enterprise Security (ES) and Splunk IT Service Intelligence (ITSI). Through data onboarding and sizing, it is determined that over 200 discrete KPIs will be tracked by ITSI and 1TB of data per day by ES. What topology ensures a scalable and performant deployment?
Which server.confattribute should be added to the master node's server.conffile when decommissioning a site in an indexer cluster?
Which CLI command converts a Splunk instance to a license slave?
A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining
that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web
logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the
forwarders are managed by another department.
Which of the following items might be the cause for this issue?
