Splunk Updated SPLK-3001 Exam Questions and Answers by solomon

Removing throttling fields would not reduce the number of false positives from a correlation search. Throttling fields are the fields that are used to group events and suppress duplicate alerts. For example, if you use src and dest as throttling fields, then the correlation search will only generate one alert per unique pair of src and dest values within the throttling window. This can help reduce the number of false positives by avoiding repeated alerts for the same issue. Removing throttling fields would increase the number of alerts generated by the correlation search, which could include more false positives. The other actions could help reduce the number of false positives by making the correlation search less sensitive or less frequent. Reducing the severity would lower the priority of the alerts and make them less visible. Increasing the throttling window would increase the time interval between alerts for the same issue. Increasing threshold sensitivity would make the correlation search more selective and require more evidence to trigger an alert. References =

• Configure correlation searches in Splunk Enterprise Security
• Optimizing correlation searches in Enterprise Security

According to the Splunk Enterprise Security Admin documentation, the minimum hardware requirements for a dedicated search head running ES are as follows: OS: 64 bit, RAM: 32 GB, CPU: 16 cores. These requirements are based on the assumption that the search head is not performing any other tasks besides running ES. The documentation also recommends having at least 500 GB of disk space for the search head. References = Splunk Enterprise Security Admin documentation