Splunk Splunk Certifications SPLK-3002 Questions & Answers

• Question 21:

  Anomaly detection can be enabled on which one of the following?

  A. KPI

  B. Multi-KPI alert

  C. Entity

  D. Service

  Correct Answer: A

  Enable anomaly detection to identify trends and outliers in KPI search results that might indicate an issue with your system.

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/AD

• Question 22:

  Which index is used to store KPI values?

  A. itsi_summary_metrics

  B. itsi_metrics

  C. itsia_service_health

  D. itsi_summary

  Correct Answer: A

  The IT Service Intelligence (ITSI) metrics summary index, itsi_summary_metrics, is a metrics-based summary index that stores KPI data.

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/MetricsIndexRef

• Question 23:

  What are valid considerations when designing an ITSI Service? (Choose all that apply.)

  A. Service access control requirements for ITSI Team Access should be considered, and appropriate teams provisioned prior to creating the ITSI Service.

  B. Entities, entity meta-data, and entity rules should be planned carefully to support the service design and configuration.

  C. Services, entities, and saved searches are stored in the ITSI app, while events created by KPI execution are stored in the itsi_summaryindex.

  D. Backfill of a KPI should always be selected so historical data points can be used immediately and alerts based on that data can occur.

  Correct Answer: AC

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/ImplementPerms

• Question 24:

  Which of the following is a recommended best practice for service and glass table design?

  A. Plan and implement services first, then build detailed glass tables.

  B. Always use the standard icons for glass table widgets to improve portability.

  C. Start with base searches, then services, and then glass tables.

  D. Design glass tables first to discover which KPIs are important.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/GTOverview

• Question 25:

  Which of the following are deployment recommendations for ITSI? (Choose all that apply.)

  A. Deployments often require an increase of hardware resources above base Splunk requirements.

  B. Deployments require a dedicated ITSI search head.

  C. Deployments may increase the number of required indexers based on the number of KPI searches.

  D. Deployments should use fastest possible disk arrays for indexers.

  Correct Answer: ABC

  You might need to increase the hardware specifications of your own Enterprise Security deployment above

  the minimum hardware requirements depending on your environment.

  Install Splunk Enterprise Security on a dedicated search head or search head cluster.

  The Splunk platform uses indexers to scale horizontally. The number of indexers required in an Enterprise

  Security deployment varies based on the data volume, data type, retention requirements, search type, and

  search concurrency.

  Reference: https://docs.splunk.com/Documentation/ES/latest/Install/DeploymentPlanning

• Question 26:

  Which index will contain useful error messages when troubleshooting ITSI issues?

  A. _introspection

  B. _internal

  C. itsi_summary

  D. itsi_notable_audit

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/TroubleshootRE

• Question 27:

  What is an episode?

  A. A workflow task.

  B. A deep dive.

  C. A notable event group.

  D. A notable event.

  Correct Answer: D

  It's a deduplicated group of notable events occurring as part of a larger sequence, or an incident or period considered in isolation.

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/EpisodeOverview

• Question 28:

  Which of the following items describe ITSI Deep Dive capabilities? (Choose all that apply.)

  A. Comparing a service's notable events over a time period.

  B. Visualizing one or more Service KPIs values by time.

  C. Examining and comparing alert levels for KPIs in a service over time.

  D. Comparing swim lane values for a slice of time.

  Correct Answer: BCD

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/DeepDives

• Question 29:

  When changing a service template, which of the following will be added to linked services by default?

  A. Thresholds.

  B. Entity Rules.

  C. New KPIs.

  D. Health score.

  Correct Answer: B

  Link multiple services to a service template to manage them collectively in IT Service Intelligence (ITSI). A service can only be linked to one service template at a time. When you link a service to a service template, any existing KPIs in the service are preserved and KPIs in the template are added to the service. You can choose to append, replace, or keep entity rules.

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/LinkST

• Question 30:

  What should be considered when onboarding data into a Splunk index, assuming that ITSI will need to use this data?

  A. Use | stats functions in custom fields to prepare the data for KPI calculations.

  B. Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data.

  C. Make sure that all fields conform to CIM, then use the corresponding module to import related services.

  D. Plan to build as many data models as possible for ITSI to leverage

  Correct Answer: B

  Reference: https://newoutlook.it/download/book/splunk/advanced-splunk.pdf