A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?
Given the requirements of ingesting 600 GB of data per day, high data availability, and high search performance while also being cost-conscious, two clustered indexers provide a balanced solution. Clustering ensures high availability by replicating data across multiple indexers, which fits the criteria of high data availability. Additionally, clustering improves search performance. Two indexers are sufficient for the stated volume, and clustering ensures that the system can handle user concurrency and maintain high performance without excessive hardware expenses.
Answer is C
https://docs.splunk.com/Documentation/Splunk/9.0.1/Capacity/Summaryofperformancerecommendations#:~:text=An%20indexer%20that%20meets%20the,while%20supporting%20a%20search%20load.
1 Search Head, 2 Indexers
C is ok
Agreed with answer C.
Answer is C
The answer should be C. Scheduled searches have nothing to do with indexing and availability.
The answer is C
"Data availability. An indexer is always available to handle incoming data, and the indexed data is available for searching." https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Aboutclusters#About_indexer_clusters_and_index_replication It means IDXC