nerdexam
Splunk

SPLK-3002 · Question #17

Which of the following describes enabling smart mode for an aggregation policy?

The correct answer is C. Edit the aggregation policy, enable smart mode, select fields to analyze, click "Save". 1. From the ITSI main menu, click Configuration > Notable Event Aggregation Policies. 2. Select a custom policy or the Default Policy. 3. Under Smart Mode grouping, enable Smart Mode. 4. Click Select fields. A dialog displays the fields found in your notable events from the…

Event Analytics and Episode Review

Question

Which of the following describes enabling smart mode for an aggregation policy?

Options

  • AConfigure ?gt; Policies ?gt; Smart Mode ?gt; Enable, select "fields", click "Save"
  • BEnable grouping in Notable Event Review, select "Smart Mode", select "fields", and click "Save"
  • CEdit the aggregation policy, enable smart mode, select fields to analyze, click "Save"
  • DEdit the notable event view, enable smart mode, select "fields", and click "Save"

How the community answered

(42 responses)
  • A
    5% (2)
  • B
    2% (1)
  • C
    83% (35)
  • D
    10% (4)

Explanation

  1. From the ITSI main menu, click Configuration > Notable Event Aggregation Policies. 2. Select a custom policy or the Default Policy. 3. Under Smart Mode grouping, enable Smart Mode. 4. Click Select fields. A dialog displays the fields found in your notable events from the last 24 C is the correct answer because smart mode is a feature of aggregation policies that allows ITSI to automatically group notable events based on the fields that have the most impact on the event occurrence. You can enable smart mode for an aggregation policy by editing the policy, selecting the smart mode option, and choosing the fields to analyze. You can also specify a minimum number of events to trigger smart mode and a maximum number of groups to create.

Topics

#aggregation policy#smart mode#notable events#policy configuration

Community Discussion

No community discussion yet for this question.

Full SPLK-3002 Practice