Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?
A.
Replace the indexer storage to solid state drives (SSD).
B.
Add more search heads and redistribute users based on the search type.
C.
Look for slow searches and reschedule them to run during an off-peak time.
D.
Add more search peers and make sure forwarders distribute data evenly across all indexers.
Before adding more search peers, you should always try to optimize the scheduled searches first.
Architecting Splunk Enterprise Deployments p.145 - point 3
Before adding more search peers, you should always try to optimize the scheduled searches first.
Architecting Splunk Enterprise Deployments p.145 - point 3
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
sadhka
Highly Voted 3 years, 11 months agoCrash_Override
Highly Voted 2 years, 6 months ago580ce47
Most Recent 3 weeks, 4 days agobobixaka
6 months, 4 weeks agoSplunkStreamer
2 years agotduarte14
2 years, 3 months agosutcocuk
2 years, 4 months agomanu78
3 years, 5 months agoYBataineh
3 years, 11 months ago