Discuss Splunk SPLK-4001 Exam Topic 10 Question 9

An SRE creates an event feed chart in a dashboard that shows a list of events that meet criteria they specify. Which of the following should they include? (select all that apply)

ACustom events that have been sent in from an external source.

BEvents created when a detector clears an alert.

CRandom alerts from active detectors.

DEvents created when a detector triggers an alert.

Suggested Answer: A, B, D

According to the web search results1, an event feed chart is a type of chart that shows a list of events that meet criteria you specify. An event feed chart can display one or more event types depending on how you specify the criteria. The event types that you can include in an event feed chart are:

Custom events that have been sent in from an external source: These are events that you have created or received from a third-party service or tool, such as AWS CloudWatch, GitHub, Jenkins, or PagerDuty. You can send custom events to Splunk Observability Cloud using the API or the Event Ingest Service.

Events created when a detector triggers or clears an alert: These are events that are automatically generated by Splunk Observability Cloud when a detector evaluates a metric or dimension and finds that it meets the alert condition or returns to normal. You can create detectors to monitor and alert on various metrics and dimensions using the UI or the API.

Therefore, option A, B, and D are correct.

Get Premium SPLK-4001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

15 comments · newest first

Frederic 11 months ago

A is a good call too, external events can provide valuable context.

Earlean 11 months ago

Wait, why would you include random alerts? That sounds chaotic!

Shawnta 11 months ago

C seems unnecessary, random alerts can just clutter the feed.

Gayla 11 months ago

I think B is also important, helps track when issues are resolved.

Herminia 11 months ago

Definitely include D, that's crucial for monitoring!

Erick 12 months ago

I practiced a similar question, and I think we should include both the triggered alerts and the cleared alerts for a complete view.

Reed 12 months ago

I feel like random alerts from active detectors might clutter the dashboard, so I'm leaning towards excluding those.

Carli 12 months ago

I think events created when a detector triggers an alert should definitely be included, but I can't recall if clearing alerts is also relevant.

Mee 1 year ago

I remember we discussed including custom events from external sources, but I'm not sure if they should always be part of the feed.

Cecily 1 year ago

I'm feeling confident about this one. The key is to identify the events that meet the specified criteria, which in this case would be custom events and detector alerts/triggers.

Kayleigh 1 year ago

Okay, I think I've got it. The question is asking what types of events should be included in the event feed chart, so I'll select the relevant options like custom events and detector alerts.

Dottie 1 year ago

Hmm, I'm a bit unsure about the difference between alerts clearing and alerts triggering. I'll need to think through that carefully.

Carman 1 year ago

This seems pretty straightforward. I'll focus on the key details like custom events, detector alerts, and detector triggers.

Cheryll 1 year ago

I'm a bit unsure about this one. Wouldn't a parallel action be better to execute the two Update Row actions simultaneously? I'll need to double-check the requirements.

Charisse 1 year ago

Okay, I think I've got it. Marsha is proactively taking actions to reduce the probability or impact of the risk event, which is the definition of a mitigation response. The additional cost is just the price of implementing those risk-reducing measures.

Splunk SPLK-4001 Exam - Topic 10 Question 9 Discussion