What should be done to increase scheduled search capacity on the search head cluster?

A three-node search head cluster is skipping a large number of searches across time.

What should be done to increase scheduled search capacity on the search head cluster?
A . Create a job server on the cluster.
B . Add another search head to the cluster.
C . server.conf captain_is_adhoc_searchhead = true.
D . Change limits.conf value for max_searches_per_cpu to a higher value.

View Answer

Answer: D

Explanation:

Changing the limits.conf value for max_searches_per_cpu to a higher value is the best option to increase scheduled search capacity on the search head cluster when a large number of searches are skipped across time. This value determines how many concurrent scheduled searches can run on each CPU core of the search head. Increasing this value will allow more scheduled searches to run at the same time, which will reduce the number of skipped searches. Creating a job server on the cluster, running the server.conf captain_is_adhoc_searchhead = true command, or adding another search head to the cluster are not the best options to increase scheduled search capacity on the search head cluster. For more information, see [Configure limits.conf] in the Splunk documentation.