SPLK-3002 practice test

1. Question 1 · 1

   After a notable event has been closed, how long will the meta data for that event remain in the KV Store by default?

   Choose one answer.

   • 6 months.
   • 9 months.
   • 1 year.
   • 3 months.

2. Question 2 · 1

   What are valid ITSI Glass Table editor capabilities? (Choose all that apply.)

   Choose all answers that apply.

   • Creating glass tables.
   • Correlation search creation.
   • Service swapping configuration.
   • Adding KPI metric lanes to glass tables.

3. Question 3 · 1

   Which of the following is the best use case for configuring a Multi-KPI Alert?

   Choose one answer.

   • Comparing content between two notable events.
   • Using machine learning to evaluate when data falls outside of an expected pattern.
   • Comparing anomaly detection between two KPIs.
   • Raising an alert when one or more KPIs indicate an outage is occurring.

4. Question 4 · 1

   When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?

   Choose one answer.

   • SA-ITOA
   • ITSI app
   • All ITSI components
   • SA-ITSI-Licensechecker

5. Question 5 · 1

   Which of the following describes entities? (Choose all that apply.)

   Choose one answer.

   • Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.
   • An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.
   • Multiple entities can share the same alias value, but must have different role values.
   • To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in Service”.

6. Question 6 · 1

   Which of the following describes a realistic troubleshooting workflow in ITSI?

   Choose one answer.

   • Correlation Search –> Deep Dive –> Notable Event
   • Service Analyzer –> Notable Event Review –> Deep Dive
   • Service Analyzer –> Aggregation Policy –> Deep Dive
   • Correlation search –> KPI –> Aggregation Policy

7. Question 7 · 1

   Which of the following accurately describes base searches used for KPIs in a service?

   Choose one answer.

   • Base searches can be used for multiple services.
   • A base search can only be used by its service and all dependent services.
   • All the metrics in a base search are used by one service.
   • All the KPIs in a service use the same base search.

8. Question 8 · 1

   Which scenario would benefit most by implementing ITSI?

   Choose one answer.

   • Monitoring of business services functionality.
   • Monitoring of system hardware.
   • Monitoring of system process statuses.
   • Monitoring of retail sales metrics.

9. Question 9 · 1

   ITSI Saved Search Scheduling is configured to use realtime_schedule = 0. Which statement is accurate about this configuration?

   Choose one answer.

   • If this value is set to 0, the scheduler bases its determination of the next scheduled search execution time on the current time.
   • If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time.
   • If this value is set to 0, the scheduler may skip scheduled execution periods.
   • If this value is set to 0, the scheduler might skip some execution periods to make sure that the scheduler is executing the searches running over the most recent time range.

10. Question 10 · 1

    What effects does the KPI importance weight of 11 have on the overall health score of a service?

    Choose one answer.

    • At least 10% of the KPIs will go critical.
    • Importance weight is unused for health scoring.
    • The service will go critical.
    • It is a minimum health indicator KPI.

11. Question 11 · 1

    Which of the following is an advantage of using adaptive time thresholds?

    Choose one answer.

    • Automatically update thresholds daily to manage dynamic changes to KPI values.
    • Automatically adjust KPI calculation to manage dynamic event data.
    • Automatically adjust aggregation policy grouping to manage escalating severity.
    • Automatically adjust correlation search thresholds to adjust sensitivity over time.

12. Question 12 · 1

    Which of the following applies when configuring time policies for KPI thresholds?

    Choose one answer.

    • A person can only configure 24 policies, one for each hour of the day.
    • They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00
    • If a person expects a KPI to change significantly through a cycle on a daily basis, don’t use it.
    • It is possible for multiple time policies to overlap.

13. Question 13 · 1

    What is the main purpose of the service analyzer?

    Choose one answer.

    • Display a list of All Services and Entities.
    • Trigger external alerts based on threshold violations.
    • Allow Analysts to add comments to Alerts.
    • Monitor overall Service and KPI status.

14. Question 14 · 1

    What is the default importance value for dependent services’ health scores?

    Choose one answer.

    • 11
    • 1
    • Unassigned
    • 10

15. Question 15 · 1

    What should be considered when onboarding data into a Splunk index, assuming that ITSI will need to use this data?

    Choose one answer.

    • Use | stats functions in custom fields to prepare the data for KPI calculations.
    • Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data.
    • Make sure that all fields conform to CIM, then use the corresponding module to import related services.
    • Plan to build as many data models as possible for ITSI to leverage

Paid access to all 45 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.