Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?
Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?
Adding more search peers (indexers) and ensuring that forwarders distribute data evenly across all indexers will provide the most search performance improvement. This approach increases the overall capacity for searches and distributes the workload more efficiently, addressing the capacity issue more effectively than the other options.
Yes D is the correct Answer
D is the correct Answer
most search performance issues can be addressed by adding search peers (indexers) - pg. 145 architecting deployments
D is the correct Answer
D is the correct answer
D is the correct answer.
Answer: D
Before adding more search peers, you should always try to optimize the scheduled searches first. Architecting Splunk Enterprise Deployments p.145 - point 3