SPLK-2002: Splunk Enterprise Certified ArchitectDemo

By Splunk · Question Mode

QuestionQ75

Performance Monitoring and Tuning

Indexing is slow, and real-time search results are delayed in a Splunk environment that has two indexers and one search head. The indexers have ample available CPU and memory. Which of the following is most likely to improve indexing performance?

  • A Increase the maximum number of hot buckets in indexes.conf
  • B Increase the number of parallel ingestion pipelines in server.conf
  • C Decrease the maximum size of the search pipelines in limits.conf
  • D Decrease the maximum concurrent scheduled searches in limits.conf
Explanation

Increasing parallelIngestionPipelines in server.conf enables multiple independent ingestion pipeline sets on each indexer. This lets the indexer process additional data streams concurrently and can increase parsing and disk-writing throughput when CPU and memory capacity is available.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!