Splunk Splunk Certifications SPLK-3002 Questions & Answers

• Question 11:

  Which of the following describes enabling smart mode for an aggregation policy?

  A. Configure –andgt; Policies –andgt; Smart Mode –andgt; Enable, select “fields”, click “Save”

  B. Enable grouping in Notable Event Review, select “Smart Mode”, select “fields”, and click “Save”

  C. Edit the aggregation policy, enable smart mode, select fields to analyze, click “Save”

  D. Edit the notable event view, enable smart mode, select “fields”, and click “Save”

  Correct Answer: A

  1.

  From the ITSI main menu, click Configuration > Notable Event Aggregation Policies.

  2.

  Select a custom policy or the Default Policy.

  3.

  Under Smart Mode grouping, enable Smart Mode.

  4.

  Click Select fields. A dialog displays the fields found in your notable events from the last 24 hours. Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/SmartMode

• Question 12:

  Which of the following are the default ports that must be configured on Splunk to use ITSI?

  A. SplunkWeb (8405), SplunkD (8519), and HTTP Collector (8628)

  B. SplunkWeb (8089), SplunkD (8088), and HTTP Collector (8000)

  C. SplunkWeb (8000), SplunkD (8089), and HTTP Collector (8088)

  D. SplunkWeb (8088), SplunkD (8089), and HTTP Collector (8000)

  Correct Answer: C

  Reference: https://splunk.github.io/docker-splunk/ARCHITECTURE.html

• Question 13:

  Which index contains ITSI Episodes?

  A. itsi_tracked_alerts

  B. itsi_grouped_alerts

  C. itsi_notable_archive

  D. itsi_summary

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/IndexOverview

• Question 14:

  Within a correlation search, dynamic field values can be specified with what syntax?

  A. fieldname

  B.

  C. %fieldname% D. eval(fieldname)

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/Searchindexes

• Question 15:

  In maintenance mode, which features of KPIs still function?

  A. KPI searches will execute but will be buffered until the maintenance window is over.

  B. KPI searches still run during maintenance mode, but results go to itsi_maintenance_summaryindex.

  C. New KPIs can be created, but existing KPIs are locked.

  D. KPI calculations and threshold settings can be modified.

  Correct Answer: A

  It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and after you start and stop your maintenance work. This gives the system an opportunity to catch up with the maintenance state and reduces the chances of ITSI generating false positives during maintenance operations.

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/AboutMW

• Question 16:

  Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)

  A. Ping a host.

  B. Send email.

  C. Include in RSS feed.

  D. Run a script.

  Correct Answer: BCD

  Throttling applies to any correlation search alert type, including notable events and actions (RSS feed, email, run script, and ticketing).

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/ConfigCS

• Question 17:

  Which capabilities are enabled through “teams”?

  A. Teams allow searches against the itsi_summaryindex.

  B. Teams restrict notable event alert actions.

  C. Teams restrict searches against the itsi_notable_auditindex.

  D. Teams allow restrictions to service content in UI views.

  Correct Answer: A

  Teams provide presentation-layer security only and not data-level security. It's still possible for a user with access to the Splunk search bar to look up ITSI summary index data.

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/ServicePerms

• Question 18:

  Which of the following describes a way to delete multiple duplicate entities in ITSI?

  A. Via c CSV upload.

  B. Via the entity lister page.

  C. Via a search using the | deleteentity command.

  D. All of the above.

  Correct Answer: A

  Import entities from CSV files that contain one or more entity definitions. Importing entities from CSV files is an efficient way to define multiple entities.

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Entity/ImportCSV

• Question 19:

  Where are KPI search results stored?

  A. The default index.

  B. KV Store.

  C. Output to a CSV lookup.

  D. The itsi_summaryindex.

  Correct Answer: D

  Search results are processed, created, and written to the itsi_summary index via an alert action.

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/BaseSearch

• Question 20:

  Which ITSI functions generate notable events? (Choose all that apply.)

  A. KPI threshold breaches.

  B. KPI anomaly detection.

  C. Multi-KPI alert.

  D. Correlation search.

  Correct Answer: ABD

  After you configure KPI thresholds, you can set up alerts to notify you when aggregate KPI severities

  change. ITSI generates notable events in Episode Review based on the alerting rules you configure.

  Anomaly detection generates notable events when a KPI IT Service Intelligence (ITSI) deviates from an

  expected pattern.

  Notable events are typically generated by a correlation search.

  Reference:

  https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/KPIthresholds

  https://docs.splunk.com/Documentation/ITSI/4.10.1/SI/AboutSI

  https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/NotableEvents