Which of the following is a characteristic of base searches?

Which of the following is a characteristic of base searches?
A . Search expression, entity splitting rules, and thresholds are configured at the base search level.
B . It is possible to filter to entities assigned to the service for calculating the metrics for the service’s KPIs.
C . The fewer KPIs that share a common base search, the more efficiency a base search provides, and anomaly detection is more efficient.
D . The base search will execute whether or not a KPI needs it.

View Answer

Answer: B

Explanation:

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/BaseSearch

A base search is a search definition that can be shared across multiple KPIs that use the same data source. Base searches can improve search performance and reduce search load by consolidating multiple similar KPIs. One of the characteristics of base searches is that it is possible to filter to entities assigned to the service for calculating the metrics for the service’s KPIs. This means that you can use entity filtering rules to specify which entities are relevant for each KPI based on the base search results.

Reference: Create KPI base searches in ITSI, [Filter entities for KPIs based on base searches]