Splunk SPLK-3001 Exam questions with correct answers

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives. Which of the following options is most likely to help performance? A. Change the search heads to do local indexing of summary searches. B. Incre CORRECT ANSWER B Which of the following threat intelligence types can ES download? (Choose all that apply.) · A. Text · B. STIX/TAXII · C. VulnScanSPL · D. SplunkEnterpriseThreatGenerator CORRECT ANSWER AB When investigating, what is the best way to store a newly-found IOC? A. Paste it into Notepad. B. Click the Add IOC button. C. Click the Add Artifact button. D. Add it in a text note to the investigation. CORRECT ANSWER C At what point in the ES installation process