nerdexam
Splunk

SPLK-4001 · Question #35

What are the best practices for creating detectors? (select all that apply)

The correct answer is A. View data at highest resolution. B. Have a consistent value. C. View detector in a chart. D. Have a consistent type of measurement. The best practices for creating detectors are: View data at highest resolution. This helps to avoid missing important signals or patterns in the data that could indicate anomalies or issues. Have a consistent value. This means that the metric or dimension used for detection…

Metrics Troubleshooting and Best Practices

Question

What are the best practices for creating detectors? (select all that apply)

Options

  • AView data at highest resolution.
  • BHave a consistent value.
  • CView detector in a chart.
  • DHave a consistent type of measurement.

How the community answered

(28 responses)
  • A
    100% (28)

Explanation

The best practices for creating detectors are: View data at highest resolution. This helps to avoid missing important signals or patterns in the data that could indicate anomalies or issues. Have a consistent value. This means that the metric or dimension used for detection should have a clear and stable meaning across different sources, contexts, and time periods. For example, avoid using metrics that are affected by changes in configuration, sampling, or aggregation. View detector in a chart. This helps to visualize the data and the detector logic, as well as to identify any false positives or negatives. It also allows to adjust the detector parameters and thresholds based on the data distribution and behavior. Have a consistent type of measurement. This means that the metric or dimension used for detection should have the same unit and scale across different sources, contexts, and time periods. For example, avoid mixing bytes and bits, or seconds and milliseconds.

Topics

#detector best practices#data resolution#measurement consistency

Community Discussion

No community discussion yet for this question.

Full SPLK-4001 Practice