nerdexam
Splunk

SPLK-5002 · Question #109

An engineer receives a report that the "Traffic over time by action" dashboard is not populating. It has been confirmed that the relevant logs are being ingested properly and they are CIM compliant…

The correct answer is B. The Network Traffic data model should be accelerated. The "Traffic over time by action" dashboard relies on the Network Traffic data model. For it to populate correctly, the data model must be accelerated, ensuring that the dashboard can pull from the accelerated summaries instead of raw data.

Performance Optimization and Troubleshooting

Question

An engineer receives a report that the "Traffic over time by action" dashboard is not populating. It has been confirmed that the relevant logs are being ingested properly and they are CIM compliant. What other configuration may be missing?

Options

  • AThe Performance data model is missing the network dataset.
  • BThe Network Traffic data model should be accelerated.
  • CThe Network Sessions data model has been deleted.
  • DThe Network Sessions data model should be accelerated.

How the community answered

(46 responses)
  • A
    7% (3)
  • B
    72% (33)
  • C
    17% (8)
  • D
    4% (2)

Explanation

The "Traffic over time by action" dashboard relies on the Network Traffic data model. For it to populate correctly, the data model must be accelerated, ensuring that the dashboard can pull from the accelerated summaries instead of raw data.

Topics

#data model acceleration#Network Traffic#dashboard troubleshooting#CIM compliance

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice