When troubleshooting KPI search performance, which search names in job activity identify base searches?

Question

Options

• AIndicator - XXXX - Base Search
• BIndicator - Shared - xxxx - ITSI Search
• CIndicator - Base - xxxx - ITSI Search
• DIndicator - Base - XXXX - Shared Search

• A
  9% (3)
• B
  71% (25)
• C
  17% (6)
• D
  3% (1)

Explanation

In the context of troubleshooting KPI search performance in Splunk IT Service Intelligence (ITSI), the search names in the job activity that identify base searches typically follow the pattern "Indicator - Shared - xxxx - ITSI Search." These base searches are fundamental components of the KPI calculation process, aggregating and preparing data for further analysis by KPIs. Identifying these base searches in the job activity is crucial for diagnosing performance issues, as these searches can be resource- intensive and impact overall system performance. Understanding the naming convention helps administrators and analysts quickly pinpoint the base searches related to specific KPIs, facilitating more effective troubleshooting and optimization of search performance within the ITSI environment.

No community discussion yet for this question.