SPLK-3002 Question #105: Real Exam Question with Answer & Explanation

The correct answer is A. He did not split the KPI by entity.. In Splunk ITSI, swim lane overlays depend on a KPI being split by entity so that each entity's individual time series can be displayed separately in the Deep Dive view. When a KPI is aggregated without an entity split, it produces a single time series value at each timestamp repr

Question

Fritz is looking at a Deep Dive with a lane showing the average percent of CPU usage across the four web servers in the web farm. Seeing a spike, he wants to add the graphs of each server on the swim lane, and selects the Lane Overlay Options to do so. No entity overlays are available for the KPI. What is wrong with his KPI configuration?

Options

AHe did not split the KPI by entity.
BHe did not enable entity filtering.
CHe configured the KPI to split by pseudo entity.
DHe configured the service with only three entities.

Explanation

In Splunk ITSI, swim lane overlays depend on a KPI being split by entity so that each entity's individual time series can be displayed separately in the Deep Dive view. When a KPI is aggregated without an entity split, it produces a single time series value at each timestamp representing the entire group (in this case, the average CPU across all web servers). Because that KPI does not contain per entity values, ITSI has nothing to overlay -- therefore no entity overlays appear in the Lane Overlay Options. This configuration mistake often happens when a KPI is defined to average values across sources without specifying an entity dimension on which to split results. Entity filtering is a separate feature that enables restricting which entities are considered in display or analytics and does not control availability of swim lane overlays; pseudo entities are artificial names that do not reflect actual system identities and are not relevant to this error; and having only three entities versus four would not prevent overlays from appearing if the KPI were correctly split by entity. The correct fix is to edit the KPI definition and configure it to split the metric results by the server entity field, such that each server has its own time series. This then enables Fritz to overlay the individual server CPU graphs on the swim lane as intended.

Community Discussion

No community discussion yet for this question.

Full SPLK-3002 Practice