QuestionQ46
Tuning Correlation SearchesA customer site is suffering from poor performance. UI response time is high, and searches take a very long time to complete. Some operations time out, and scheduler logs show errors indicating that too many concurrent searches are being started. A total of 6 correlation searches are scheduled, and they have already been tuned to eliminate false positives.
Which of the following options is most likely to improve performance?
- A Change the search heads to do local indexing of summary searches.
- B Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.
- C Increase memory and CPUs on the search head(s) and add additional indexers.
- D If indexed realtime search is enabled, disable it for the notable index.
Community Discussion