Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?
Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?
Increasing the number of parallel ingestion pipelines in server.conf is most likely to improve indexing performance. This setting allows the indexers to handle more data streams simultaneously, effectively utilizing the available CPU and memory resources to boost indexing speed. Options such as increasing the number of hot buckets or decreasing the maximum size of search pipelines do not directly address the issue of delayed real-time search results due to slow indexing.
Should be B
B is correct answer
B is correct
Parallel ingestion increases performance https://conf.splunk.com/files/2016/slides/harnessing-performance-and-scalability-with-parallelization.pdf
I went with D as the parallelization features are intended for customers with excess CPU cores and I/O capacity to leverage their hardware for improved performance across the indexing tier.