Splunk SPLK-4001 Exam - Topic 10 Question 9 Discussion

Actual exam question for Splunk's SPLK-4001 exam

Question #: 9
Topic #: 10

An SRE creates an event feed chart in a dashboard that shows a list of events that meet criteria they specify. Which of the following should they include? (select all that apply)

ACustom events that have been sent in from an external source.

BEvents created when a detector clears an alert.

CRandom alerts from active detectors.

DEvents created when a detector triggers an alert.

Show Suggested Answer

Suggested Answer: A, B, D

According to the web search results1, an event feed chart is a type of chart that shows a list of events that meet criteria you specify. An event feed chart can display one or more event types depending on how you specify the criteria. The event types that you can include in an event feed chart are:

Custom events that have been sent in from an external source: These are events that you have created or received from a third-party service or tool, such as AWS CloudWatch, GitHub, Jenkins, or PagerDuty. You can send custom events to Splunk Observability Cloud using the API or the Event Ingest Service.

Events created when a detector triggers or clears an alert: These are events that are automatically generated by Splunk Observability Cloud when a detector evaluates a metric or dimension and finds that it meets the alert condition or returns to normal. You can create detectors to monitor and alert on various metrics and dimensions using the UI or the API.

Therefore, option A, B, and D are correct.

by Ryan at Dec 08, 2023, 10:56 AM

Limited Time Offer

25%

Off

Get Premium SPLK-4001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Frederic

3 months ago

A is a good call too, external events can provide valuable context.

upvoted 0 times

...

Earlean

3 months ago

Wait, why would you include random alerts? That sounds chaotic!

upvoted 0 times

...

Shawnta

3 months ago

C seems unnecessary, random alerts can just clutter the feed.

upvoted 0 times

...

Gayla

4 months ago

I think B is also important, helps track when issues are resolved.

upvoted 0 times

...

Herminia

4 months ago

Definitely include D, that's crucial for monitoring!

upvoted 0 times

...

Erick

4 months ago

I practiced a similar question, and I think we should include both the triggered alerts and the cleared alerts for a complete view.

upvoted 0 times

...

Reed

4 months ago

I feel like random alerts from active detectors might clutter the dashboard, so I'm leaning towards excluding those.

upvoted 0 times

...

Carli

4 months ago

I think events created when a detector triggers an alert should definitely be included, but I can't recall if clearing alerts is also relevant.

upvoted 0 times

...

Mee

5 months ago

I remember we discussed including custom events from external sources, but I'm not sure if they should always be part of the feed.

upvoted 0 times

...

Cecily

5 months ago

I'm feeling confident about this one. The key is to identify the events that meet the specified criteria, which in this case would be custom events and detector alerts/triggers.

upvoted 0 times

...

Kayleigh

5 months ago

Okay, I think I've got it. The question is asking what types of events should be included in the event feed chart, so I'll select the relevant options like custom events and detector alerts.

upvoted 0 times

...

Dottie

5 months ago

Hmm, I'm a bit unsure about the difference between alerts clearing and alerts triggering. I'll need to think through that carefully.

upvoted 0 times

...

Carman

5 months ago

This seems pretty straightforward. I'll focus on the key details like custom events, detector alerts, and detector triggers.

upvoted 0 times

...

Cheryll

5 months ago

I'm a bit unsure about this one. Wouldn't a parallel action be better to execute the two Update Row actions simultaneously? I'll need to double-check the requirements.

upvoted 0 times

...

Charisse

5 months ago

Okay, I think I've got it. Marsha is proactively taking actions to reduce the probability or impact of the risk event, which is the definition of a mitigation response. The additional cost is just the price of implementing those risk-reducing measures.

upvoted 0 times

...