Splunk O11y Cloud Metrics User (SPLK-4001) Certification Sample Questions

02. A plot of cpu.utilization has three filters: host:web-01, host:web-02 and region:eu. Host web-01 is in eu, web-02 is in us, and web-03 is in eu. Which two statements describe what the plot shows?
(Choose two.)
a) Only the MTS from web-01, as the one series that matches a listed host value and also carries eu
b) The MTS from web-01 and web-02, because a region filter is ignored whenever a host filter is also present
c) Values of the same dimension are combined with OR, while filters on different dimensions must all match at once
d) No MTS at all, because no single series can carry both web-01 and web-02 as its host

03. One detector watches memory.used, reported in bytes, across a fleet of cloud instances that range from 8 GB to 256 GB of memory, with a static threshold of 7 GB. It fires constantly on the large instances, where 7 GB is a small share of their memory, and fires on the small ones only when they are nearly full. The team wants to keep one detector with one shared threshold for the whole fleet.
What change makes a single threshold meaningful for every instance?
a) Apply a Mean aggregation across the fleet and keep the 7 GB threshold on the result
b) Raise the byte threshold to 200 GB, so the large instances stop firing and the fleet shares it
c) Add a 15-minute duration to the rule, so that only memory staying above 7 GB for a while fires
d) Alert on memory used as a percentage of each instance's total, with one percentage threshold

04. A chart sums requests.count across 40 web hosts in an autoscaling group. The newest point often dips sharply, and a minute later the same interval is redrawn at the usual level. A detector on the same summed signal has fired and cleared twice this week at the moment of such a dip, with no user impact reported. Several hosts are known to send their datapoints a little late.
Which statements about this pattern are accurate?
(Choose two.)
a) The late datapoints are discarded, so the dip stays in the chart's history once it passes
b) The detector evaluated the incomplete sum and saw a condition the full data never met
c) The dip is the sum of only the hosts whose datapoints had arrived, not a fall in traffic
d) The dip means the group removed hosts, and the redraw then hides that from the chart

05. While investigating slow responses, an engineer built a chart of cpu.utilization filtered to host:web-01. They then created a detector from that chart, intending it to cover all twelve web hosts. A week later web-05 ran above the threshold for forty minutes and no alert was triggered.
Why did the detector not alert?
a) Its signal kept the chart's filter to host:web-01, so it evaluates only that host
b) It evaluated a rolled-up view of the chart, which averaged the forty-minute rise on web-05 away
c) A detector created from a chart alerts only for the MTS with the highest value at each evaluation
d) A detector created from a chart evaluates only while that chart is open on a dashboard someone is viewing

06. An autoscaling group runs cloud instances that typically live 20 to 40 minutes before being replaced. The team alerts on each instance's cpu.utilization, and on-call engineers receive a steady stream of alerts for instances that are gone by the time anyone looks. What matters to users is the service's request error rate.
Which alerting approach best fits this environment?
a) Alert on the service's error rate, aggregated across instances by the service dimension they share
b) Keep the per-instance alerts and send them to a low-severity channel from which no one is paged
c) Replace the CPU alerts with one detector per instance, created as each instance starts
d) Keep the per-instance alerts and add a duration longer than an instance's lifetime, so only lasting problems fire

07. Latency is reported by 2,000 hosts, each carrying a region dimension. The on-call team wants one alert per region when that region's 95th-percentile latency is high, rather than an alert for every individual host. How should the detector's signal be built?
a) Apply a P95 function across all 2,000 hosts together, with no grouping
b) Apply a P95 function to the latency signal, grouped by region
c) Build one detector per host and route every alert to the region's on-call team
d) Filter the signal to one host per region and alert on that host's latency

08. A detector uses the built-in Outlier Detection condition on request.latency for 120 interchangeable web servers, comparing each server with the population norm rather than with a fixed value. Which statements about this detector are true?
(Choose two.)
a) It can stay quiet when every server slows down together, because the norm rises along with them
b) It can flag a server whose latency is modest in absolute terms but well out of line with its peers
c) It needs a one-week timeshift of each server's own latency before it can establish what counts as normal for that server
d) It evaluates only the slowest server in each interval, and ignores the rest of the population

09. An infrastructure team uses a single-instance dashboard that shows CPU, memory, disk and network for one Linux host at a time. During an incident, request latency is up across the whole service, and nobody yet knows which of its 200 hosts is responsible. Which approach best finds the host at fault?
a) Step through the single-instance dashboard one host at a time until one of them looks unusual
b) Clone the dashboard for each host and collect the copies in a dashboard group to compare
c) Widen the single-instance dashboard's time range so that its charts show all 200 hosts together
d) Spot the outlying host on charts that plot every host, then open the single-instance view

10. A detector compares an order service's request count with the same signal timeshifted by one day. Traffic is heavy Monday to Friday and light at weekends. Every Monday morning the detector fires because traffic is far above Sunday's, although Monday traffic is normal. Which change best fits this signal?
a) Keep the one-day timeshift and mute the detector each Monday morning with a recurring muting rule
b) Apply a rolling mean over a full day, so weekend and weekday traffic are averaged together
c) Timeshift by one week, so each day is compared with the same day and hour of the previous week
d) Replace the comparison with a static threshold set above the highest weekday traffic