ExamGecko
Search Search Login
Home Home / Splunk / SPLK-3002
Question list
Search
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

Which of the following are the default ports that must be configured on Splunk to use ITSI?
There are two departments using ITSI. Finance and Sales. Analysts in each department should not be allowed to see each other's services. What are the role configuration steps required to accomplish this?
Which of the following statements is accurate when using multiple policies?
When in maintenance mode, which of the following is accurate?
Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)
ITSI Saved Search Scheduling is configured to use realtime_schedule = 0. Which statement is accurate about this configuration?
When troubleshooting KPI search performance, which search names in job activity identify base searches?
Which of the following is a good use case for creating a custom module?
When working with a notable event group in the Notable Events Review dashboard, which of the following can be set at the individual or group level?
There are two Smart Mode configuration settings that control how fields affect grouping. Which of these is correct?

Question 16 - SPLK-3002 discussion

Report
Export

In distributed search, which components need to be installed on instances other than the search head?

A.
SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
Answers
A.
SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
B.
SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
Answers
B.
SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
C.
SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
Answers
C.
SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
D.
SA-ITSI-Licensechecker on indexers.
Answers
D.
SA-ITSI-Licensechecker on indexers.
Suggested answer: A

Explanation:

SA-IndexCreationis required on all indexers. For non-clustered, distributed environments, copySA-IndexCreationto$SPLUNK_HOME/etc/apps/on individual indexers.

In distributed search, the components that need to be installed on instances other than the search head are SA-IndexCreation and SA-ITSI-Licensechecker on indexers. SA-IndexCreation is an add-on that creates the indexes required by ITSI, such as itsi_summary and itsi_tracked_alerts. SA-ITSI-Licensechecker is an add-on that monitors the license usage of ITSI and generates alerts when the license limit is exceeded or about to expire. These components need to be installed on indexers because they handle the data ingestion and storage functions for ITSI. The other components, such as ITSI app and SA-ITOA, need to be installed on the search head(s) because they handle the search management and presentation functions for ITSI.

Reference:Install IT Service Intelligence in a distributed environment

Show Answer
asked 23/09/2024
TIAM HERVE
47 questions
PreviousPreviousNextNext
User
Your answer:
0 comments
Sorted by

Leave a comment first

ExamGecko

Copyright @2023 ExamGecko | All right reserved

Mail us: [email protected]
About us
Contact us
Twitter X
Facebook
Medium
Convert VPLUS to PDF
Open VPLUS files Easily and Quickly
Privacy Policy
Disclaimer
Terms