Splunk SOAR Certified Automation Developer — Question 42

What should be considered when onboarding data into a Splunk index, assuming that ITSI will need to use this data?

Answer options

• A. Use | stats functions in custom fields to prepare the data for KPI calculations.
• B. Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data.
• C. Make sure that all fields conform to CIM, then use the corresponding module to import related services.
• D. Plan to build as many data models as possible for ITSI to leverage

Correct answer: B

Explanation

Option B is correct because it emphasizes checking for pre-built KPIs which can optimize the onboarding process by ensuring compatibility with existing modules. Option A, while useful for custom calculations, does not address the need for leveraging existing KPIs. Option C focuses on CIM compliance but misses the importance of utilizing pre-built KPIs. Option D suggests building data models but overlooks the crucial step of ensuring the data can directly work with existing KPIs.