Splunk Enterprise Certified Architect — Question 85

In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files.
What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

Answer options

• A. Total daily indexing volume, number of peer nodes, and number of accelerated searches.
• B. Total daily indexing volume, number of peer nodes, replication factor, and search factor.
• C. Total daily indexing volume, replication factor, search factor, and number of search heads.
• D. Replication factor, search factor, number of accelerated searches, and total disk size across cluster.

Correct answer: B

Explanation

The correct answer is B because the total daily indexing volume is essential for calculating the disk consumption, and the number of peer nodes, replication factor, and search factor are needed to understand how data is distributed and duplicated across the cluster. Options A, C, and D include irrelevant factors or omit critical information necessary for this calculation.