Which of the following are ways to reduce flapping of a detector? (select all that apply)

Question

Options

• AConfigure a duration or percent of duration for the alert.
• BEstablish a reset threshold for the detector.
• CEnable the anti-flap setting in the detector options menu.
• DApply a smoothing transformation (like a rolling mean) to the input data for the detector.

• A
  76% (16)
• B
  5% (1)
• C
  19% (4)

Explanation

According to the Splunk Lantern article Resolving flapping detectors in Splunk Infrastructure Monitoring, flapping is a phenomenon where alerts fire and clear repeatedly in a short period of time, due to the signal fluctuating around the threshold value. To reduce flapping, the article suggests the following ways: Configure a duration or percent of duration for the alert: This means that you require the signal to stay above or below the threshold for a certain amount of time or percentage of time before triggering an alert. This can help filter out noise and focus on more persistent issues. Apply a smoothing transformation (like a rolling mean) to the input data for the detector: This means that you replace the original signal with the average of its last several values, where you can specify the window length. This can reduce the impact of a single extreme observation and make the signal less fluctuating.

No community discussion yet for this question.