Splunk IT Service Intelligence Certified Admin Exam SPLK-3002 Test Questions and Answers

Page 1 of 1

1. After a notable event has been closed, how long will the meta data for that event remain in the KV Store by default?

6 months.

9 months.

1 year.

3 months.

2. What are valid ITSI Glass Table editor capabilities? (Choose all that apply.)

Creating glass tables.

Correlation search creation.

Service swapping configuration.

Adding KPI metric lanes to glass tables.

3. Which of the following are deployment recommendations for ITSI? (Choose all that apply.)

Deployments often require an increase of hardware resources above base Splunk requirements.

Deployments require a dedicated ITSI search head.

Deployments may increase the number of required indexers based on the number of KPI searches.

Deployments should use fastest possible disk arrays for indexers.

4. Which of the following items describe ITSI Backup and Restore functionality? (Choose all that apply.)

A pre-configured default ITSI backup job is provided that can be modified, but not deleted.

ITSI backup is inclusive of KV Store, ITSI Configurations, and index dependencies.

kvstore_to_json.py can be used in scripts or command line to backup ITSI for full or partial backups.

ITSI backups are stored as a collection of JSON formatted files.

5. Which of the following is a good use case regarding defining entities for a service?

Automatically associate entities to services using multiple entity aliases.

All of the entities have the same identifying field name.

Being able to split a CPU usage KPI by host name.

KPI total values are aggregated from multiple different category values in the source events.

6. Which of the following is a characteristic of base searches?

Search expression, entity splitting rules, and thresholds are configured at the base search level.

It is possible to filter to entities assigned to the service for calculating the metrics for the service’s KPIs.

The fewer KPIs that share a common base search, the more efficiency a base search provides, and anomaly detection is more efficient.

The base search will execute whether or not a KPI needs it.

7. Which of the following is an advantage of using adaptive time thresholds?

Automatically update thresholds daily to manage dynamic changes to KPI values.

Automatically adjust KPI calculation to manage dynamic event data.

Automatically adjust aggregation policy grouping to manage escalating severity.

Automatically adjust correlation search thresholds to adjust sensitivity over time.

Splunk Certification SPLK-3002 Free Questions – Check The High-Quality SPLK-3002 Test Questions