Download Free Splunk SPLK-3002 Real Questions and Answers

test2022-02-14T09:23:37+00:00

Splunk IT Service Intelligence (ITSI) Certified Admin exam is the final step towards completion of the Splunk ITSI Certified Admin certification. If you are preparing for your Splunk SPLK-3002 exam, you can now utilize this free SPLK-3002 practice test to gauge your readiness. You will get a comprehensive SPLK-3002 Questions and Answers that will ensure your success on the first attempt!

To help you prepare for the exam, take a free SPLK-3002 practice test.

Page 1 of 2

1. When creating a custom deep dive, what color are services/KPIs in maintenance mode within the topology view?

Gray

Purple

Gear Icon

Blue

2. Which of the following describes entities? (Choose all that apply.)

Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.

An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.

Multiple entities can share the same alias value, but must have different role values.

To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in Service”.

3. Which of the following is a valid type of Multi-KPI Alert?

Score over composite.

Value over time.

Status over time.

Rise over run.

4. Which of the following items apply to anomaly detection? (Choose all that apply.)

Use AD on KPIs that have an unestablished baseline of data points. This allows the ML pattern to perform it’s magic.

A minimum of 24 hours of data is needed for anomaly detection, and a minimum of 4 entities for cohesive analysis.

Anomaly detection automatically generates notable events when KPI data diverges from the pattern.

There are 3 types of anomaly detection supported in ITSI: adhoc, trending, and cohesive.

5. Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)

Ping a host.

Send email.

Include in RSS feed.

Run a script.

6. In maintenance mode, which features of KPIs still function?

KPI searches will execute but will be buffered until the maintenance window is over.

KPI searches still run during maintenance mode, but results go to itsi_maintenance_summary index.

New KPIs can be created, but existing KPIs are locked.

KPI calculations and threshold settings can be modified.

7. Which index contains ITSI Episodes?

itsi_tracked_alerts

itsi_grouped_alerts

itsi_notable_archive

itsi_summary

8. Which of the following describes a realistic troubleshooting workflow in ITSI?

Correlation Search C> Deep Dive C> Notable Event

Service Analyzer C> Notable Event Review C> Deep Dive

Service Analyzer C> Aggregation Policy C> Deep Dive

Correlation search C> KPI C> Aggregation Policy

9. Which of the following applies when configuring time policies for KPI thresholds?

A person can only configure 24 policies, one for each hour of the day.

They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00

If a person expects a KPI to change significantly through a cycle on a daily basis, don’t use it.

It is possible for multiple time policies to overlap.

10. What effects does the KPI importance weight of 11 have on the overall health score of a service?

At least 10% of the KPIs will go critical.

Importance weight is unused for health scoring.

The service will go critical.

It is a minimum health indicator KP

Page 2 of 2

11. Which of the following is a good use case regarding defining entities for a service?

Automatically associate entities to services using multiple entity aliases.

All of the entities have the same identifying field name.

Being able to split a CPU usage KPI by host name.

KPI total values are aggregated from multiple different category values in the source events.

12. Which index will contain useful error messages when troubleshooting ITSI issues?

_introspection

_internal

itsi_summary

itsi_notable_audit

13. What should be considered when onboarding data into a Splunk index, assuming that ITSI will need to use this data?

Use | stats functions in custom fields to prepare the data for KPI calculations.

Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data.

Make sure that all fields conform to CIM, then use the corresponding module to import related services.

Plan to build as many data models as possible for ITSI to leverage

14. When changing a service template, which of the following will be added to linked services by default?

Thresholds.

Entity Rules.

New KPIs.

Health score.

15. Which of the following describes a way to delete multiple duplicate entities in ITSI?

Via c CSV upload.

Via the entity lister page.

Via a search using the | deleteentity command.

All of the above.