Splunk Enterprise Certified Architect Practice Test

For a customer planning to ingest 600 GB of data per day, how many indexers are recommended for their deployment focusing on high availability?

1. Two indexers not in a cluster, assuming users run many long searches.

2. Three indexers not in a cluster, assuming a long data retention period.

3. Two indexers clustered, assuming high availability is the greatest priority.

4. Two indexers clustered, assuming a high volume of saved/scheduled searches.

The correct answer is: Two indexers clustered, assuming high availability is the greatest priority.

The recommendation for using two clustered indexers is centered around the principle of high availability, which is essential for ensuring that data remains accessible and resilient against potential failures. In a clustered configuration, indexers work together to replicate data and provide failover capabilities, which means that if one indexer goes down, the other can take over, ensuring continuous service without data loss. Clustering is particularly advantageous in environments where data ingestion is significant, such as the 600 GB per day in this scenario. By deploying two indexers in a cluster, the customer benefits from the automatic redistribution of load and redundancy that clustering offers. This setup minimizes the risks associated with single points of failure, making it ideal for environments where uptime and data integrity are critical. In contrast, configurations that involve indexers not in a cluster do not provide the same level of reliability. If an indexer fails in such setups, data accessibility could be compromised, and users might face issues while running long or complex searches. High volume of saved or scheduled searches also benefits from clustering, as it can optimize resource utilization across the indexers rather than overwhelming a single instance. Thus, the choice of two clustered indexers is the most effective to ensure high availability for the customer’s needs.