ES recommended installation is on a dedicated search head with only the default installation, due to the number of resources required for ES to run efficiently.
D is correct
ES generally requires a new, dedicated search head or search head
cluster
– ES is only compatible with other CIM-compatible apps
– ES adds a large number of searches and search results
Administering Splunk Enterprise Security page 113
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
oksey
Highly Voted 3 years, 7 months agoSriAkula
Highly Voted 2 years, 6 months agoadamsca
Most Recent 2 weeks agoqtygbapjpesdayazko
1 year, 2 months agobrettw
2 years, 4 months agoguirax
2 years, 6 months agoandy73
2 years, 6 months ago