Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?
A. Setting the cluster search factor to N-1.
B. Increasing the number of buckets per index.
C. Decreasing the data model acceleration range.
D. Setting the cluster replication factor to N-1.
|
Download Printable PDF. VALID exam to help you PASS. |
 |
A. Setting the cluster search factor to N-1 is the answer
would love an explanation.
Replication factor creates rawfiles and search factor creates searchable copies , raw files are 15% and tsidx is 35% , so search factor has larger footprint than replication factor.