Question 26

What happens when an index cluster peer freezes a bucket?
  • Question 27

    Which of the following is the most efficient search?
  • Question 28

    Where are Splunk Data Model Acceleration (DMA) summaries stored?
  • Question 29

    An index receives approximately 50GB of data per day per indexer at an even and consistent rate. The customer would like to keep this data searchable for a minimum of 30 days. In addition, they have hourly scheduled searches that process a week's worth of data and are quite sensitive to search performance.
    Given ideal conditions (no restarts, nor drops/bursts in data volume), and following PS best practices, which of the following sets of indexes.conf settings can be leveraged to meet the requirements?
    frozenTimePeriodInSecs, maxDataSize, maxVolumeDataSizeMB, maxHotBuckets
  • Question 30

    What is the default push mode for a search head cluster deployer app configuration bundle?