A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?
To address poor performance characterized by high UI response time, long search durations, and errors in the scheduler logs due to too many concurrent searches, the most effective solution is to increase the hardware resources (memory and CPUs) on the search heads and add additional indexers. This approach directly enhances the processing power and capacity of the system, allowing it to handle more concurrent searches and improve overall performance.
I say the answer is C. I originally thought the answer would be D but the question indicated that we have the searches set to scheduled instead of realtime already. "You have six correlation searches scheduled".
Suggested Answer: C and chatgpt says the same xD
Is there a reference to given answer? I think the answer is D.
I don't think you can change this definition per index, but per search