A correlation search emails the on-call analyst for every parking-meter result, and 5,000 meters flap overnight. What Adaptive Response configuration change is needed?
Select an answer to reveal the explanation.
Short Explanation
Five thousand flapping meters will drown the on-call phone if every result sends mail. Raise the trigger threshold so Adaptive Response fires when the pile is real. Per-event email is a pager that never sleeps.
Full Explanation
Adaptive Response must be bounded with trigger conditions. Emailing on every parking-meter result at city scale creates noise rather than response. Raising the threshold (or similar result-count or time bounds) keeps AR useful. Disabling AR entirely or widening to index=* makes the flood worse or throws away the control.