ExamTopics Logo
Mail Us[email protected]
Menu
Splunk Discussions
exam questions

Exam SPLK-3003 All Questions

View all questions & answers for the SPLK-3003 exam
Go to Exam

Exam SPLK-3003 topic 1 question 7 discussion

Actual exam question from Splunk's SPLK-3003
Question #: 7
Topic #: 1
[All SPLK-3003 Questions]

The customer has an indexer cluster supporting a wide variety of search needs, including scheduled search, data model acceleration, and summary indexing.
Here is an excerpt from the cluster mater's server.conf:

Which strategy represents the minimum and least disruptive change necessary to protect the searchability of the indexer cluster in case of indexer failure?

  • A. Enable maintenance mode on the CM to prevent excessive fix-up and bring the failed indexer back online.
  • B. Leave replication_factor=2, increase search_factor=2 and enable summary_replication.
  • C. Convert the cluster to multi-site and modify the server.conf to be site_replication_factor=2, site_search_factor=2.
  • D. Increase replication_factor=3, search_factor=2 to protect the data, and allow there to always be a searchable copy.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by simo988 at Jan. 11, 2021, 7:38 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
simo988
Highly Voted 4 years, 3 months ago
The correct answer is B https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Clustersandsummaryreplication
upvoted 9 times
...
marinatedcohort
Most Recent 6 months, 3 weeks ago
Selected Answer: D
D - this is the only answer that increases redundancy (replication_factor) which is the main point of the question
upvoted 1 times
...
spl_bonn
2 years, 6 months ago
Selected Answer: B
I would also say that B is the correct one.
upvoted 2 times
...
Redtonyeah
2 years, 11 months ago
Selected Answer: B
B is the correct
upvoted 2 times
...
SasnycoN
3 years, 1 month ago
Answer is "B" as is "...minimum and least disruptive change"
upvoted 3 times
...
jugulinho
3 years, 11 months ago
D is best choice
upvoted 2 times
...
jbabbin
4 years, 3 months ago
https://docs.splunk.com/Documentation/Splunk/8.0.2/Indexer/Migratetomultisite
upvoted 1 times
pbandj12
3 years, 7 months ago
"...minimum and least disruptive change"...migrating to multisite, is not that.
upvoted 1 times
...
...
jbabbin
4 years, 3 months ago
Splunk reference is for rep factor of 3 in order to tolerate a failure of 2 nodes; which assumes that the cluster is made of of the min of 3 nodes. B would assume that the cluster is 2 nodes and the nodes would have a search each https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Thereplicationfactor
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago