It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and
after you start and stop your maintenance work. This gives the system an opportunity to catch up
with the maintenance state and reduces the chances of ITSI generating false positives during
maintenance operations.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/AboutMW
A is the correct answer because KPI searches still run during maintenance mode, but the results are
buffered until the maintenance window is over. This means that no alerts are triggered during
maintenance mode, but once it ends, the buffered results are processed and alerts are generated if
necessary. You cannot create new KPIs or modify existing KPIs during maintenance mode. Reference:
[Overview of maintenance windows in ITSI]
