Splunk Exam SPLK-3002 Topic 1 Question 46 Discussion

1. From the ITSI main menu, clickConfiguration>Notable Event Aggregation Policies.

2. Select a custom policy or the Default Policy.

3. Under Smart Mode grouping, enableSmart Mode.

4. ClickSelect fields. A dialog displays the fields found in your notable events from the last 24 hours.

C is the correct answer because smart mode is a feature of aggregation policies that allows ITSI to automatically group notable events based on the fields that have the most impact on the event occurrence. You can enable smart mode for an aggregation policy by editing the policy, selecting the smart mode option, and choosing the fields to analyze. You can also specify a minimum number of events to trigger smart mode and a maximum number of groups to create. Reference:Configure smart mode for aggregation policies in ITSI