If a correlation search cannot be run at the configured time, which scheduling option should an engineer use to ensure there are no backfill gaps in data?

The correct answer is B. Continuous. The Continuous scheduling option ensures that if a correlation search is delayed or cannot run at its scheduled time, Splunk will still execute it later and cover the missed time range. This prevents backfill gaps in data and ensures no events are overlooked.

Performance Optimization and Troubleshooting

Question

Options

ADefault
BContinuous
CReal-time
DAuto

How the community answered

(55 responses)

A
15% (8)
B
75% (41)
C
4% (2)
D
7% (4)

Explanation

The Continuous scheduling option ensures that if a correlation search is delayed or cannot run at its scheduled time, Splunk will still execute it later and cover the missed time range. This prevents backfill gaps in data and ensures no events are overlooked.

Topics

#continuous scheduling#correlation search backfill#data gap prevention#search scheduling

Community Discussion

No community discussion yet for this question.

Full SPLK-5002 Practice