SPLK-2002: Splunk Enterprise Certified ArchitectDemo

Question

A particular search is performing poorly. The search must run across All Time and is expected to return very few results. Analysis indicates that the search accesses a very large number of buckets in a large index.

What action would most significantly improve this search's performance?

A Change this to a real-time search using an All Time window.
B Increase the number of indexing pipelines.
C Increase the disk I/O hardware performance.
D Set indexed_realtime_use_by_default = true in limits.conf.

Explanation

A super-sparse search that returns few results while examining many index buckets is I/O-bound because the indexer must inspect the buckets to locate matches. Increasing disk I/O performance directly reduces the bottleneck. Additional indexing pipelines improve ingestion throughput, while real-time and indexed-real-time settings do not optimize this historical All Time search.

Learn more

How search types affect Splunk Enterprise performance

SPLK-2002: Splunk Enterprise Certified ArchitectDemo

AstroTutor

Notes

Readiness

QuestionQ115

Community Discussion