nerdexam
Splunk

SPLK-5002 · Question #35

An engineer adds a custom event status of 'Testing' and accidentally makes it the new default status. Their SOC calculates some metrics based on Notable status change sequences, starting from the…

The correct answer is C. Mean Time to Triage, Dwell Time. By accidentally setting 'Testing' as the default status instead of 'New', metrics that rely on the correct starting status in the notable lifecycle are impacted. Specifically, Mean Time to Triage (time from 'New' to first triage action) and Dwell Time (time from creation to…

Performance Optimization and Troubleshooting

Question

An engineer adds a custom event status of 'Testing' and accidentally makes it the new default status. Their SOC calculates some metrics based on Notable status change sequences, starting from the old default status of 'New'. Which metrics can be affected by this mistake?

Options

  • AMean Time to Respond, Mean Time to Resolve
  • BNo metrics are impacted
  • CMean Time to Triage, Dwell Time
  • DMean Time to Resolve, Dwell Time

How the community answered

(44 responses)
  • A
    18% (8)
  • B
    5% (2)
  • C
    70% (31)
  • D
    7% (3)

Explanation

By accidentally setting 'Testing' as the default status instead of 'New', metrics that rely on the correct starting status in the notable lifecycle are impacted. Specifically, Mean Time to Triage (time from 'New' to first triage action) and Dwell Time (time from creation to meaningful action) can be miscalculated, since the workflow no longer begins with the intended default state.

Topics

#notable status#mean time to triage#dwell time#SOC metrics

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice