Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

• A.Adding search peers increases the maximum size of search results.
• B.Adding RAM to an existing search heads provides additional search capacity.
• C.Adding search peers increases the search throughput as search load increases.
• D.Adding search heads provides additional CPU cores to run more concurrent searches.

Comment: *

Name: *

Email: *

Verification: *

A customer has a multisite cluster with site1 and site2 configured. They want to configure search heads in these sites to get search results only from data stored on their local sites. Which step prevents this behavior?

• A.Set site=site0 in the [general] stanza of server.conf on the search head.
• B.Configure site_search_factor = site1:1, total:2.
• C.Implement only two indexers per site.
• D.Configure site_search_factor = site1:2, total:3.

Comment: *

Name: *

Email: *

Verification: *

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

• A.Auto
• B.False
• C.True
• D.None

Comment: *

Name: *

Email: *

Verification: *

To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

• A.repFactor = 0
• B.replicate = 0
• C.repFactor = auto
• D.replicate = auto

Comment: *

Name: *

Email: *

Verification: *

What is needed to ensure that high-velocity sources will not have forwarding delays to the indexers?

• A.Increase the default value of sessionTimeout in server, conf.
• B.Increase the default limit for maxKBps in limits.conf.
• C.Decrease the value of forceTimebasedAutoLB in outputs. conf.
• D.Decrease the default value of phoneHomelntervallnSecs in deploymentclient .conf.

Comment: *

Name: *

Email: *

Verification: *