Exam SPLK-3003 All QuestionsBrowse all questions from this exam
Question 55

A customer has a multisite cluster (two sites, each site in its own data center) and users experiencing a slow response when searches are run on search heads located in either site. The Search Job Inspector shows the delay is being caused by search heads on either site waiting for results to be returned by indexers on the opposing site. The network team has confirmed that there is limited bandwidth available between the two data centers, which are in different geographic locations.

Which of the following would be the least expensive and easiest way to improve search performance?

    Correct Answer: A

    To improve search performance in a multisite cluster with limited bandwidth between data centers, the least expensive and easiest solution is to configure the site_search_factor. This will ensure a searchable copy exists in the local site for each search head, reducing the dependency on remote indexers and minimizing delays caused by limited inter-site bandwidth.

Discussion
hpbdcbOption: A

A is the only making sense

jcisco123Option: A

A is the answer - verified by ChatGPT.

otb_282Option: A

I think A. https://docs.splunk.com/Documentation/Splunk/9.0.1/Indexer/Sitesearchfactor