Splunk Enterprise Certified Architect — Question 63

A high volume source and a low volume source feed into the same index. Which of the following items best describe the impact of this design choice? (Choose all that apply.)

Answer options

• A. High volume data is optimized by the presence of low volume data.
• B. Low volume data will improve the compression factor of the high volume data.
• C. Search speed on low volume data will be slower than necessary.
• D. Low volume data may move out of the index based on volume rather than age.

Correct answer: C, D

Explanation

Option C is correct because the presence of high volume data can overshadow low volume data, causing slower search speeds. Option D is also correct as low volume data can be evicted based on its volume in comparison to high volume data, rather than how long it has been stored. Options A and B are incorrect since low volume data does not optimize high volume data or improve its compression factor.