Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

1. A. High performance SAN should never be used.
2. B. Enable NFS for storing hot and warm buckets.
3. C. The recommended RAID setup is RAID 10 (1 + 0).
4. D. Virtualized environments are usually preferred over bare metal for Splunk indexers.

Correct Answer: C

What is the logical first step when starting a deployment plan?

1. A. Inventory the currently deployed logging infrastructure.
2. B. Determine what apps and use cases will be implemented.
3. C. Gather statistics on the expected adoption of Splunk for sizing.
4. D. Collect the initial requirements for the deployment from all stakeholders.

Correct Answer: D

The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

1. A. rawdata is: 10%, tsidx is: 40%
2. B. rawdata is: 15%, tsidx is: 35%
3. C. rawdata is: 35%, tsidx is: 15%
4. D. rawdata is: 40%, tsidx is: 10%

Correct Answer: B

What is the algorithm used to determine captaincy in a Splunk search head cluster?

1. A. Raft distributed consensus.
2. B. Rapt distributed consensus.
3. C. Rift distributed consensus.
4. D. Round-robin distribution consensus.

Correct Answer: A

Which search will show all deployment client messages from the client (UF)?

1. A. index=_audit component=DC* host=<ds> | stats count by message
2. B. index=_audit component=DC* host=<uf> | stats count by message
3. C. index=_internal component= DC* host=<uf> | stats count by message
4. D. index=_internal component=DS* host=<ds> | stats count by message

Correct Answer: D