Splunk SPLK-3002 Splunk IT Service Intelligence Certified Admin Exam Online Training

When you prepare the SPLK-3002 Splunk IT Service Intelligence Certified Admin Exam exam, Exam4Training can help you save a lot of time. It is your guarantee to pass %renzehng% SPLK-3002 certification. Do you want to have the Splunk SPLK-3002 Splunk IT Service Intelligence Certified Admin Exam Online Training? Hurry up to visit Exam4Training to purchase Splunk SPLK-3002 Splunk IT Service Intelligence Certified Admin Exam Online Training. In addition, before you buy it, you can download the free demo which will help you to know more details.

Page 1 of 2

 Loading...

1. Which scenario would benefit most by implementing ITSI?

Monitoring of business services functionality.

Monitoring of system hardware.

Monitoring of system process statuses

Monitoring of retail sales metrics.

 Loading...

2. When in maintenance mode, which of the following is accurate?

Once the window is over, KPIs and notable events will begin to be generated again.

KPIs are shown in blue while in maintenance mode.

Maintenance mode slots are scheduled on a per hour basis.

Service health scores and KPI events are deleted until the window is over.

 Loading...

3. What effects does the KPI importance weight of 11 have on the overall health score of a service?

At least 10% of the KPIs will go critical.

Importance weight is unused for health scoring.

The service will go critical.

It is a minimum health indicator KP

 Loading...

4. Which of the following is a good use case regarding defining entities for a service?

Automatically associate entities to services using multiple entity aliases.

All of the entities have the same identifying field name.

Being able to split a CPU usage KPI by host name.

KPI total values are aggregated from multiple different category values in the source events.

 Loading...

5. What are valid ITSI Glass Table editor capabilities? (Choose all that apply.)

Creating glass tables.

Correlation search creation.

Service swapping configuration.

Adding KPI metric lanes to glass tables.

 Loading...

6. When changing a service template, which of the following will be added to linked services by default?

Thresholds.

Entity Rules.

New KPIs.

Health score.

 Loading...

7. After a notable event has been closed, how long will the meta data for that event remain in the KV Store by default?

6 months.

9 months.

1 year.

3 months.

 Loading...

8. What should be considered when onboarding data into a Splunk index, assuming that ITSI will need to use this data?

Use | stats functions in custom fields to prepare the data for KPI calculations.

Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data.

Make sure that all fields conform to CIM, then use the corresponding module to import related services.

Plan to build as many data models as possible for ITSI to leverage

 Loading...

9. Which of the following best describes a default deep dive?

It initially shows the health scores for all services.

It initially shows the highest importance KPIs.

It initially shows all of the KPIs for a selected service.

It initially shows all the entity swim lanes.

 Loading...

10. When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?

SA-ITOA

ITSI app

All ITSI components

SA-ITSI-Licensechecker

Page 2 of 2

 Loading...

11. Which of the following are deployment recommendations for ITSI? (Choose all that apply.)

Deployments often require an increase of hardware resources above base Splunk requirements.

Deployments require a dedicated ITSI search head.

Deployments may increase the number of required indexers based on the number of KPI searches.

Deployments should use fastest possible disk arrays for indexers.

 Loading...

12. Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)

Ping a host.

Send email.

Include in RSS feed.

Run a script.

 Loading...

13. Which of the following describes entities? (Choose all that apply.)

Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.

An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.

Multiple entities can share the same alias value, but must have different role values.

To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in Service”.

 Loading...

14. Which of the following is a characteristic of base searches?

Search expression, entity splitting rules, and thresholds are configured at the base search level.

It is possible to filter to entities assigned to the service for calculating the metrics for the service’s KPIs.

The fewer KPIs that share a common base search, the more efficiency a base search provides, and anomaly detection is more efficient.

The base search will execute whether or not a KPI needs it.

 Loading...

15. In maintenance mode, which features of KPIs still function?

KPI searches will execute but will be buffered until the maintenance window is over.

KPI searches still run during maintenance mode, but results go to itsi_maintenance_summary index.

New KPIs can be created, but existing KPIs are locked.

KPI calculations and threshold settings can be modified.

 Loading...

16. Where are KPI search results stored?

The default index.

KV Store.

Output to a CSV lookup.

The itsi_summary index.

 Loading...

17. Which of the following is an advantage of using adaptive time thresholds?

Automatically update thresholds daily to manage dynamic changes to KPI values.

Automatically adjust KPI calculation to manage dynamic event data.

Automatically adjust aggregation policy grouping to manage escalating severity.

Automatically adjust correlation search thresholds to adjust sensitivity over time.

 Loading...

18. Which of the following are the default ports that must be configured on Splunk to use ITSI?

SplunkWeb (8405), SplunkD (8519), and HTTP Collector (8628)

SplunkWeb (8089), SplunkD (8088), and HTTP Collector (8000)

SplunkWeb (8000), SplunkD (8089), and HTTP Collector (8088)

SplunkWeb (8088), SplunkD (8089), and HTTP Collector (8000)

 Loading...

19. Which of the following items describe ITSI Backup and Restore functionality? (Choose all that apply.)

A pre-configured default ITSI backup job is provided that can be modified, but not deleted.

ITSI backup is inclusive of KV Store, ITSI Configurations, and index dependencies.

kvstore_to_json.py can be used in scripts or command line to backup ITSI for full or partial backups.

ITSI backups are stored as a collection of JSON formatted files.

 Loading...

20. When creating a custom deep dive, what color are services/KPIs in maintenance mode within the topology view?

Gray

Purple

Gear Icon

Blue

 Loading...