A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance.
What is the best practice for installing ES?
A . Install ES on the existing search head.
B . Add a new search head and install ES on it.
C . Increase the number of CPUs and amount of memory on the search head, then install E
E . Delete the non-CIM-compliant apps from the search head, then install E
Answer: B
Explanation:
Reference: https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf