Splunk Enterprise Certified Architect — Question 5

Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

Answer options

• A. Setting the cluster search factor to N-1.
• B. Increasing the number of buckets per index.
• C. Decreasing the data model acceleration range.
• D. Setting the cluster replication factor to N-1.

Correct answer: A

Explanation

Setting the cluster search factor to N-1 allows for one less copy of the data to be stored across the indexers, directly reducing the amount of disk space required. The other options either do not impact the total data stored as significantly or pertain to configurations that do not primarily affect disk size in the same manner.