ExamGecko
Question list
Search
Search

List of questions

Search

Question 29 - SPLK-2002 discussion

Report
Export

A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?

A.

Create a job server on the cluster.

Answers
A.

Create a job server on the cluster.

B.

Add another search head to the cluster.

Answers
B.

Add another search head to the cluster.

C.

server.conf captain_is_adhoc_searchhead = true.

Answers
C.

server.conf captain_is_adhoc_searchhead = true.

D.

Change limits.conf value for max_searches_per_cpu to a higher value.

Answers
D.

Change limits.conf value for max_searches_per_cpu to a higher value.

Suggested answer: D

Explanation:

Changing the limits.conf value for max_searches_per_cpu to a higher value is the best option to increase scheduled search capacity on the search head cluster when a large number of searches are skipped across time. This value determines how many concurrent scheduled searches can run on each CPU core of the search head. Increasing this value will allow more scheduled searches to run at the same time, which will reduce the number of skipped searches. Creating a job server on the cluster, running the server.conf captain_is_adhoc_searchhead = true command, or adding another search head to the cluster are not the best options to increase scheduled search capacity on the search head cluster. For more information, see [Configure limits.conf] in the Splunk documentation.

asked 13/11/2024
Srikar Gude
31 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first