Splunk Exam SPLK-2002 Topic 9 Question 75 Discussion

Actual exam question for Splunk's SPLK-2002 exam

Question #: 75
Topic #: 9

[All SPLK-2002 Questions]

A Splunk deployment is being architected and the customer will be using Splunk Enterprise Security (ES) and Splunk IT Service Intelligence (ITSI). Through data onboarding and sizing, it is determined that over 200 discrete KPIs will be tracked by ITSI and 1TB of data per day by ES. What topology ensures a scalable and performant deployment?

ATwo search heads, one for ITSI and one for ES.

BTwo search head clusters, one for ITSI and one for ES.

COne search head cluster with both ITSI and ES installed.

DOne search head with both ITSI and ES installed.

Show Suggested Answer

Suggested Answer: A, C

by Eladia at Oct 02, 2023, 09:18 PM

Limited Time Offer

25%

Off

Get Premium SPLK-2002 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ciara

1 months ago

Clearly option C is the way to go. I mean, who needs performance or scalability when you can just cram everything onto one search head cluster? It'll be fine, right? *nervous laughter*

upvoted 0 times

Hyman

9 days ago

Yeah, option C seems risky. It's better to separate the workloads to ensure a more stable and efficient deployment.

upvoted 0 times

...

Kenia

10 days ago

I agree, having dedicated search head clusters for each application will prevent any performance issues that may arise from overloading a single search head.

upvoted 0 times

...

Derrick

19 days ago

I think option B is the best choice. Having separate search head clusters for ITSI and ES will ensure better performance and scalability.

upvoted 0 times

...

Kate

1 months ago

I'm with Alfred on this one. Two search head clusters is the way to go. It's the only option that ensures you can scale and handle the data load without everything grinding to a halt.

upvoted 0 times

Nadine

3 days ago

Yeah, I think splitting up the search head clusters is the way to go to ensure everything runs smoothly with that amount of data.

upvoted 0 times

...

Daryl

5 days ago

I think having separate search head clusters for ITSI and ES makes the most sense in terms of scalability and performance.

upvoted 0 times

...

Danilo

1 months ago

I agree with you, having two search head clusters is definitely the best option for this scenario.

upvoted 0 times

...

Peggy

2 months ago

Oh man, option D is just begging for trouble. One search head handling both ITSI and ES? That's like trying to fit an elephant and a giraffe in a Smart car. Not happening!

upvoted 0 times

...

Alfred

2 months ago

Two search head clusters, one for each, is definitely the way to go. You don't want to risk overloading a single search head with that kind of data volume. Separating them is the smart move.

upvoted 0 times

Christiane

19 days ago

Two search head clusters, one for each, is definitely the way to go.

upvoted 0 times

...

Margret

23 days ago

B) Two search head clusters, one for ITSI and one for ES.

upvoted 0 times

...

Vilma

25 days ago

A) Two search heads, one for ITSI and one for ES.

upvoted 0 times

...

Frederica

2 months ago

Choosing a single search head with both ITSI and ES installed seems like a recipe for disaster with that much data. I'd go with option B to keep them separated for better scalability and performance.

upvoted 0 times