In which index are active notable events stored?

In Splunk IT Service Intelligence (ITSI), notable events are created and managed within the context of

its Event Analytics framework. These notable events are stored in the itsi_tracked_alerts index. This

index is specifically designed to hold the active notable events that are generated by ITSI's

correlation searches, which are based on the conditions defined for various services and their KPIs.

Notable events are essentially alerts or issues that need to be investigated and resolved. The

itsi_tracked_alerts index enables efficient storage, querying, and management of these events,

facilitating the ITSI's event management and review process. The other options, such as

itsi_notable_archive and itsi_notable_audit, serve different purposes, such as archiving resolved

notable events and auditing changes to notable event configurations, respectively. Therefore, the

correct answer for where active notable events are stored is the itsi_tracked_alerts index.