A customer has a multisite cluster (two sites, each site in its own data center) and users experiencing a slow response when searches are run on search heads located in either site. The Search Job Inspector shows the delay is being caused by search heads on either site waiting for results to be returned by indexers on the opposing site. The network team has confirmed that there is limited bandwidth available between the two data centers, which are in different geographic locations.
Which of the following would be the least expensive and easiest way to improve search performance?

• A.Set the site setting on each indexer in the server.conf clustering stanza to be the same for all indexers regardless of site.
• B.Install a network pipe with more bandwidth between the two data centers.
• C.Configure site_search_factor to ensure a searchable copy exists in the local site for each search head.
• D.Move all indexers and search heads in one of the data centers into the same site.

Comment: *

Name: *

Email: *

Verification: *

A customer has a Universal Forwarder (UF) with an inputs.conf monitoring its splunkd.log. The data is sent through a heavy forwarder to an indexer. Where does the Index time parsing occur?

• A.Indexer
• B.Search head
• C.Universal forwarder
• D.Heavy forwarder

Comment: *

Name: *

Email: *

Verification: *

What is required to setup the HTTP Event Collector (HEC)?

• A.Each HEC input requires a unique name but token values can be shared.
• B.Each HEC input requires an existing forwarder output group.
• C.Each HEC input entry must contain a valid token.
• D.Each HEC input requires a Source name field.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the most efficient search?

• A.Option C
• B.Option D
• C.Option A
• D.Option B

Comment: *

Name: *

Email: *

Verification: *

A customer has downloaded the Splunk App for AWS from Splunkbase and installed it in a search head cluster following the instructions using the deployer. A power user modifies a dashboard in the app on one of the search head cluster members. The app containing an updated dashboard is upgraded to the latest version by following the instructions via the deployer.
What happens?

• A.The updated dashboard will not be deployed globally to all users, due to the conflict with the power user's modified version of the dashboard.
• B.The updated dashboard will be available to the power user.
• C.The updated dashboard will not be available to the power user; they will see their modified version.
• D.Applying the search head cluster bundle will fail due to the conflict.

Comment: *

Name: *

Email: *

Verification: *