A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?

Question

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.

Which of the following options is most likely to help performance?

Jason Potter · Accepted Answer

Increase memory and CPUs on the search head(s) and add additional indexers.

Jason Potter · Answer

Change the search heads to do local indexing of summary searches.

Jason Potter · Answer

Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.

Jason Potter · Answer

If indexed realtime search is enabled, disable it for the notable index.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 88 - SPLK-3001 discussion

Suggested answer: C

0 comments