Splunk SOAR Certified Automation Developer — Question 37

Which of the following is a characteristic of base searches?

Answer options

• A. Search expression, entity splitting rules, and thresholds are configured at the base search level.
• B. It is possible to filter to entities assigned to the service for calculating the metrics for the service’s KPIs.
• C. The fewer KPIs that share a common base search, the more efficiency a base search provides, and anomaly detection is more efficient.
• D. The base search will execute whether or not a KPI needs it.

Correct answer: B

Explanation

Option B is correct because it accurately describes the ability to filter entities for KPI metrics. Options A and D are incorrect as they discuss configuration and execution aspects that do not directly define base searches. Option C misrepresents the relationship between the number of KPIs and the efficiency of a base search.