Which of the following is most likely to improve indexing performance?

Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers.

Which of the following is most likely to improve indexing performance?
A . Increase the maximum number of hot buckets in indexes.conf
B . Increase the number of parallel ingestion pipelines in server.conf
C . Decrease the maximum size of the search pipelines in limits.conf
D . Decrease the maximum concurrent scheduled searches in limits.conf

View Answer

Answer: D