For which ITSI function is it a best practice to use a 15-30 minute time buffer?

Question

Options

• ACorrelation searches.
• BAdaptive thresholding.
• CMaintenance windows
• DAnomaly detection.

• A
  4% (1)
• B
  4% (1)
• C
  92% (22)

Explanation

Maintenance windows in Splunk ITSI require a 15-30 minute time buffer because alerts and KPI evaluations don't stop instantaneously - there's a lag between when a window is configured and when the system fully suppresses notifications. Adding buffer time before and after the actual maintenance period prevents false alerts from firing at the edges of the window, ensuring clean suppression throughout the planned downtime.

Why the distractors are wrong:

• A (Correlation searches): These are tuned for detection sensitivity and timing offsets, but no standard 15-30 minute buffer best practice applies to them.
• B (Adaptive thresholding): This feature learns from historical KPI data over longer time windows (hours/days), not short buffers.
• D (Anomaly detection): Anomaly detection uses statistical baselines, not scheduled time buffers.

Memory tip: Think "M for Margin" - Maintenance windows need a Margin (buffer) on both sides, just like you'd arrive early and leave late for any real-world maintenance job to avoid chaos at the edges.

No community discussion yet for this question.