Discuss Splunk SPLK-3002 Exam Topic 11 Question 11

Which ITSI functions generate notable events? (Choose all that apply.)

AKPI threshold breaches.

BKPI anomaly detection.

CMulti-KPI alert.

DCorrelation search.

Suggested Answer: A, B, D

After you configure KPI thresholds, you can set up alerts to notify you when aggregate KPI severities change. ITSI generates notable events in Episode Review based on the alerting rules you configure.

Anomaly detection generates notable events when a KPI IT Service Intelligence (ITSI) deviates from an expected pattern.

Notable events are typically generated by a correlation search.

https://docs.splunk.com/Documentation/ITSI/4.10.1/SI/AboutSI

Get Premium SPLK-3002 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Amina 11 months ago

I’m surprised D is even an option here!

Maryanne 11 months ago

Yup, A and B are spot on!

Gail 12 months ago

Wait, does D really generate notable events?

Keva 12 months ago

I think C is also a notable one.

Latrice 12 months ago

Definitely A and B for sure!

Junita 1 year ago

I feel like all of these options could potentially generate events, but I definitely recall KPI threshold breaches being a primary one.

Nidia 1 year ago

I practiced a similar question, and I think both KPI anomaly detection and multi-KPI alert were mentioned as notable event generators.

Kris 1 year ago

I'm not entirely sure about the correlation search. I think it might be more about data analysis than generating events.

Brynn 1 year ago

I remember studying KPI threshold breaches as a key function for generating notable events. That seems like a solid choice.

Marion 1 year ago

I'm pretty sure the Compliance app is sending an electronic transaction, so that would be an external output (EO) for them. And the Laboratory Management app is updating an ILF, so that's an EI for them as well.

Shayne 1 year ago

I feel like this question could relate to the types of service improvements we reviewed, but I'm torn between the options.

Andra 1 year ago

Definitely the recovery point objective (RPO). We need to know how much data we can afford to lose before we start prioritizing our response.

Splunk SPLK-3002 Exam - Topic 11 Question 11 Discussion