SPLK-4001 · Question #43
When writing a detector with a large number of MTS, such as memory. free in a deployment with 30,000 hosts, it is possible to exceed the cap of MTS that can be contained in a single plot. Which of…
The correct answer is B. Add a filter to narrow the scope of the measurement. Add a filter to narrow the scope of the measurement. A filter is a way to reduce the number of metric time series (MTS) that are displayed on a chart or used in a detector. A filter specifies one or more dimensions and values that the MTS must have in order to be included. For…
Question
When writing a detector with a large number of MTS, such as memory. free in a deployment with 30,000 hosts, it is possible to exceed the cap of MTS that can be contained in a single plot. Which of the choices below would most likely reduce the number of MTS below the plot cap?
Options
- ASelect the Sharded option when creating the plot.
- BAdd a filter to narrow the scope of the measurement.
- CAdd a restricted scope adjustment to the plot.
- DWhen creating the plot, add a discriminator.
How the community answered
(61 responses)- A16% (10)
- B72% (44)
- C8% (5)
- D3% (2)
Explanation
Add a filter to narrow the scope of the measurement. A filter is a way to reduce the number of metric time series (MTS) that are displayed on a chart or used in a detector. A filter specifies one or more dimensions and values that the MTS must have in order to be included. For example, if you want to monitor the memory.free metric only for hosts that belong to a certain cluster, you can add a filter like cluster:my-cluster to the plot or detector. This will exclude any MTS that do not have the cluster dimension or have a different value for it. Adding a filter can help you avoid exceeding the plot cap, which is the maximum number of MTS that can be contained in a single plot. The plot cap is 100,000 by default, but it can be changed by contacting Splunk Support.
Topics
Community Discussion
No community discussion yet for this question.