Exam SPLK-3003 topic 1 question 63 discussion

Actual exam question from Splunk's SPLK-3003

Question #: 63
Topic #: 1

A customer has three users and is planning to ingest 250GB of data per day. They are concerned with search uptime, can tolerate up to a two-hour downtime for the search tier, and want advice on single search head versus a search head cluster. (SHC).
Which recommendation is the most appropriate?

A. The customer should deploy two active search heads behind a load balancer to support HA.
B. The customer should deploy a SHC with a single member for HA; more members can be added later.
C. The customer should deploy a SHC, because it will be required to support the high volume of data.
D. The customer should deploy a single search head with a warm standby search head and an rsync process to synchronize configurations.

Show Suggested Answer

Suggested Answer: D 🗳️

by jugulinho at May 27, 2021, 2:16 p.m.

Comments

Submit Cancel

b5white

11 months, 4 weeks ago

Selected Answer: B

The doc that BamBamMantell shared shows that this answer is an option.

upvoted 1 times

...

BamBamMantell

2 years, 10 months ago

B - Single Member Search head cluster - no HA required at this time, data volumes less than 300Gb, so only single node needed, but it gives an upgrade path. https://docs.splunk.com/Documentation/Splunk/9.0.1/DistSearch/DeploysinglememberSHC

upvoted 4 times

itsnicky

2 months, 1 week ago

In B it says "with a single member for HA" which immediately makes it incorrect, from your link: "The main benefit of a search head cluster is to provide high availability search. To fulfill that benefit, the cluster must comprise at least three members." I think D is the correct answer.

upvoted 1 times

...