Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?
Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?
The recommended RAID setup for Splunk indexing, which is read/write intensive, is RAID 10 (1 + 0). This RAID configuration provides a good balance between high performance and redundancy. RAID 10 combines the mirroring of RAID 1 with the striping of RAID 0, which enhances both read and write speeds, making it ideal for ensuring data integrity and performance in an environment that performs frequent disk operations.
C, page 58 enterprise
C is the answer
C is the answer
C Since this is focused on indexer performance, A can be ruled out because SAN is one of the faster storage technologies available. B can be ruled out because hot buckets need the fastest performance possible, and NFS is relatively slow (it usually runs over non-dedicated networks that are slower than those used by SAN). C is valid because it is a performance option - RAID 10 is faster than RAID5/6 while providing better redundancy. D can be ruled out because virtualized environments will always give lower raw performance than bare metal (despite having other advantages).
A B and D
High Performance SAN is better than an NFS as far as performance is concerned, so your answer of A and B are conflicting. The correct answer is C
I forgot to mention that the tradeoff for the ease of using Virtualized environments is a slight performance hit that is introduced in the abstracting the hardware layer. So Bare Metal will always have high performance.