Which approach can resolve this issue?

A cybersecurity engineer notices a delay in retrieving indexed data during a security incident investigation. The Splunk environment has multiple indexers but only one search head.

Which approach can resolve this issue?
A . Increase search head memory allocation.
B . Optimize search queries to use tstats instead of raw searches.
C . Configure a search head cluster to distribute search queries.
D . Implement accelerated data models for faster querying.

View Answer

Answer: C