Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?
A.
Increase the maximum number of hot buckets in indexes.conf
B.
Increase the number of parallel ingestion pipelines in server.conf
C.
Decrease the maximum size of the search pipelines in limits.conf
D.
Decrease the maximum concurrent scheduled searches in limits.conf
I went with D as the parallelization features are intended for customers with excess CPU cores and I/O capacity to leverage their hardware for improved performance across the indexing tier.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
M_K_S
Highly Voted 3 years, 3 months agoCrash_Override
Highly Voted 1 year, 12 months agoginfaced
Most Recent 8 months agoBob_Hob
1 week, 5 days agoSplunky_Manny
2 years, 8 months agomanu78
2 years, 10 months ago