Splunk Enterprise Certified Architect — Question 56

Indexing is slow in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

Answer options

• A. Increase the number of parallel ingestion pipelines in inputs.conf.
• B. Increase the number of parallel ingestion pipelines in server.conf.
• C. Increase the maximum number of hot buckets in indexes.conf.
• D. Increase the maximum number of hot buckets in server.conf.

Correct answer: B

Explanation

Increasing the number of parallel ingestion pipelines in server.conf allows for more simultaneous data processing, which can significantly enhance indexing performance. The other options either affect different configurations or do not specifically target the improvement of ingestion speed.