nerdexam
Splunk

SPLK-4001 · Question #17

A customer is sending data from a machine that is over-utilized. Because of a lack of system resources, datapoints from this machine are often delayed by up to 10 minutes. Which setting can be…

The correct answer is A. Max Delay. Max Delay is a parameter that specifies the maximum amount of time that the analytics engine can wait for data to arrive for a specific detector. For example, if Max Delay is set to 10 minutes, the detector will wait for only a maximum of 10 minutes even if some data points…

Metrics Alerts and Detectors

Question

A customer is sending data from a machine that is over-utilized. Because of a lack of system resources, datapoints from this machine are often delayed by up to 10 minutes. Which setting can be modified in a detector to prevent alerts from firing before the datapoints arrive?

Options

  • AMax Delay
  • BDuration
  • CLatency
  • DExtrapolation Policy

How the community answered

(34 responses)
  • A
    74% (25)
  • B
    18% (6)
  • C
    6% (2)
  • D
    3% (1)

Explanation

Max Delay is a parameter that specifies the maximum amount of time that the analytics engine can wait for data to arrive for a specific detector. For example, if Max Delay is set to 10 minutes, the detector will wait for only a maximum of 10 minutes even if some data points have not arrived. By default, Max Delay is set to Auto, allowing the analytics engine to determine the appropriate amount of time to wait for data points. In this case, since the customer knows that the data from the over-utilized machine can be delayed by up to 10 minutes, they can modify the Max Delay setting for the detector to 10 minutes. This will prevent the detector from firing alerts before the data points arrive, and avoid false positives or missing data.

Topics

#Max Delay#late data#detector settings#datapoint latency

Community Discussion

No community discussion yet for this question.

Full SPLK-4001 Practice