Which of the following describe migration from single-site to multisite index replication?

1. A. A master node is required at each site.
2. B. Multisite policies apply to new data only.
3. C. Single-site buckets instantly receive the multisite policies.
4. D. Multisite total values should not exceed any single-site factors.

Correct Answer: D

Which Splunk internal index contains licenserelated events?

1. A. _audit
2. B. _license
3. C. _internal
4. D. _introspection

Correct Answer: C

Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)

1. A. Install Enterprise Security on the deployer.
2. B. Install Enterprise Security on a staging instance.
3. C. Copy the Enterprise Security configurations to the deployer.
4. D. Use the deployer to deploy Enterprise Security to the cluster members.

Correct Answer: AD

To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

1. A. Indexers
2. B. Forwarders
3. C. Search head
4. D. Cluster master

Correct Answer: AB

Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

1. A. Increase the maximum number of hot buckets in indexes.conf
2. B. Increase the number of parallel ingestion pipelines in server.conf
3. C. Decrease the maximum size of the search pipelines in limits.conf
4. D. Decrease the maximum concurrent scheduled searches in limits.conf

Correct Answer: D