MENU
A Splunk deployment is being architected and the customer will be using Splunk Enterprise Security (ES) and Splunk IT Service Intelligence (ITSI). Through data onboarding and sizing, it is determined that over 200 discrete KPIs will be tracked by ITSI and 1TB of data per day by ES. What topology ensures a scalable and performant deployment?
Suggested Answer: A, C
Get Premium SPLK-2002 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
35 comments · newest first
CO
Corinne
11 months ago
C could work, but I’d still prefer B for future growth.
AN
An
11 months ago
Definitely not A, that would bottleneck performance.
TI
Tina
11 months ago
Wait, can one cluster really manage both ITSI and ES effectively?
LU
Luz
11 months ago
I agree, two search head clusters can handle the load better!
DE
Denae
11 months ago
Option B seems like the best choice for scalability.
NA
Nana
12 months ago
I’m a bit confused about the differences between clusters and single search heads. I thought option A could work, but now I’m leaning towards option C after reviewing the requirements.
AL
Allene
12 months ago
I practiced a similar question, and I think having separate clusters for ITSI and ES could help with managing the KPIs better. So, option B seems reasonable.
FR
Francine
12 months ago
I'm not entirely sure, but I feel like having a single search head cluster for both ITSI and ES could lead to performance issues. Maybe option C isn't ideal?
JU
Juliann
1 year ago
I remember we discussed the importance of scalability, especially with such a high volume of data. I think option B might be the best choice.
WH
Whitney
1 year ago
I'm leaning towards option B - two search head clusters, one for ITSI and one for ES. That way, each component can be scaled and optimized independently to handle the respective workloads. Trying to cram both ITSI and ES onto a single search head cluster might not be the best approach given the scale.
SO
Sol
1 year ago
Okay, let's see. With over 200 KPIs for ITSI and 1TB of data per day for ES, that's a significant amount of data and workload. I'm thinking a single search head might not be able to handle that, so a search head cluster is probably the way to go.
LA
Lauran
1 year ago
Hmm, I'm a bit unsure about this one. The question is asking about the overall topology, but it's also mentioning specific details like the number of KPIs and data volume. I'll need to think through how those factors impact the architecture.
CA
Carissa
1 year ago
This looks like a pretty straightforward Splunk architecture question. I think the key is to consider the scale and performance requirements mentioned in the prompt.
CA
Carman
1 year ago
Okay, I've got this. The question is asking for a solution to run containerized apps without installing them on the session hosts. That means we need a way to package and deploy the apps in a containerized format. MSIX app packages seem like the logical choice here.
TI
Titus
1 year ago
I remember studying about encryption for protecting sensitive data, it seems like the most secure method we discussed.
MA
Malcom
1 year ago
This seems like a straightforward question about data privacy and security. I'll carefully read through the options and think about which one best fits the description of improper PII disclosure.
CI
Ciara
1 year ago
Clearly option C is the way to go. I mean, who needs performance or scalability when you can just cram everything onto one search head cluster? It'll be fine, right? *nervous laughter*
HY
Hyman
1 year ago
Yeah, option C seems risky. It's better to separate the workloads to ensure a more stable and efficient deployment.
KE
Kenia
1 year ago
I agree, having dedicated search head clusters for each application will prevent any performance issues that may arise from overloading a single search head.
DE
Derrick
1 year ago
I think option B is the best choice. Having separate search head clusters for ITSI and ES will ensure better performance and scalability.
KA
Kate
1 year ago
I'm with Alfred on this one. Two search head clusters is the way to go. It's the only option that ensures you can scale and handle the data load without everything grinding to a halt.
NA
Nadine
1 year ago
Yeah, I think splitting up the search head clusters is the way to go to ensure everything runs smoothly with that amount of data.
DA
Daryl
1 year ago
I think having separate search head clusters for ITSI and ES makes the most sense in terms of scalability and performance.
DA
Danilo
1 year ago
I agree with you, having two search head clusters is definitely the best option for this scenario.
PE
Peggy
1 year ago
Oh man, option D is just begging for trouble. One search head handling both ITSI and ES? That's like trying to fit an elephant and a giraffe in a Smart car. Not happening!
AL
Alfred
1 year ago
Two search head clusters, one for each, is definitely the way to go. You don't want to risk overloading a single search head with that kind of data volume. Separating them is the smart move.
CH
Christiane
1 year ago
Two search head clusters, one for each, is definitely the way to go.
MA
Margret
1 year ago
B) Two search head clusters, one for ITSI and one for ES.
VI
Vilma
1 year ago
A) Two search heads, one for ITSI and one for ES.
FR
Frederica
1 year ago
Choosing a single search head with both ITSI and ES installed seems like a recipe for disaster with that much data. I'd go with option B to keep them separated for better scalability and performance.
MI
Millie
1 year ago
Yeah, it's important to keep them separated to avoid any performance issues with that much data being processed.
ST
Stanford
1 year ago
I agree, having separate search head clusters for ITSI and ES would definitely help with scalability.
QU
Queen
2 years ago
I disagree, I believe option C is more efficient as it allows for easier management of both ITSI and ES on a single search head cluster.
NE
Nelida
2 years ago
I agree with Ty, having separate search head clusters for ITSI and ES makes sense for scalability.
TY
Ty
2 years ago
I think option B is the best choice.