What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?
What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?
To handle more simultaneous searches, such as ad-hoc and scheduled queries, increasing the number of CPUs in the search head is essential. This is because searches are typically CPU-intensive operations, and adding more CPUs enables the search head to process more search requests concurrently.
B is the correct
Per the provided Splunk URL reference https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCarchitecture Scroll down to section titled, How the cluster handles concurrent search quotas, "Overall search quota. This quota determines the maximum number of historical searches (combined scheduled and ad hoc) that the cluster can run concurrently. This quota is configured with max_Searches_per_cpu and related settings in limits.conf."
Answer: B https://docs.splunk.com/Documentation/Splunk/8.1.1/Capacity/Accommodatemanysimultaneoussearches
B. CPUs To increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head, you would need to increase the number of CPUs. This is because searches are a CPU-intensive operation, and adding more CPUs would allow the search head to handle more search requests at the same time. While increasing the disk, memory, or network interface cards could improve other aspects of search performance, they would not directly increase the number of searches that can be run simultaneously.
B is correct