Valid SPLK-3002 Exam Q&A PDF SPLK-3002 Dump is Ready (Updated 54 Questions)
Exam Questions and Answers for SPLK-3002 Study Guide
NEW QUESTION 28
Which of the following are deployment recommendations for ITSI? (Choose all that apply.)
- A. Deployments should use fastest possible disk arrays for indexers.
- B. Deployments require a dedicated ITSI search head.
- C. Deployments may increase the number of required indexers based on the number of KPI searches.
- D. Deployments often require an increase of hardware resources above base Splunk requirements.
Answer: B,C,D
Explanation:
Explanation
You might need to increase the hardware specifications of your own Enterprise Security deployment above the minimum hardware requirements depending on your environment.
Install Splunk Enterprise Security on a dedicated search head or search head cluster.
The Splunk platform uses indexers to scale horizontally. The number of indexers required in an Enterprise Security deployment varies based on the data volume, data type, retention requirements, search type, and search concurrency.
NEW QUESTION 29
Which of the following describes a way to delete multiple duplicate entities in ITSI?
- A. Via the entity lister page.
- B. Via a search using the | deleteentity command.
- C. Via c CSV upload.
- D. All of the above.
Answer: C
Explanation:
Explanation
Import entities from CSV files that contain one or more entity definitions. Importing entities from CSV files is an efficient way to define multiple entities.
NEW QUESTION 30
Where are KPI search results stored?
- A. The default index.
- B. Output to a CSV lookup.
- C. The itsi_summary index.
- D. KV Store.
Answer: C
Explanation:
Explanation
Search results are processed, created, and written to the itsi_summary index via an alert action.
NEW QUESTION 31
Which of the following is an advantage of using adaptive time thresholds?
- A. Automatically update thresholds daily to manage dynamic changes to KPI values.
- B. Automatically adjust KPI calculation to manage dynamic event data.
- C. Automatically adjust aggregation policy grouping to manage escalating severity.
- D. Automatically adjust correlation search thresholds to adjust sensitivity over time.
Answer: A
NEW QUESTION 32
Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)
- A. Ping a host.
- B. Send email.
- C. Run a script.
- D. Include in RSS feed.
Answer: B,C,D
Explanation:
Explanation
Throttling applies to any correlation search alert type, including notable events and actions (RSS feed, email, run script, and ticketing).
NEW QUESTION 33
When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?
- A. All ITSI components
- B. SA-ITOA
- C. SA-ITSI-Licensechecker
- D. ITSI app
Answer: C
Explanation:
Explanation
Install SA-ITSI-Licensechecker and SA-UserAccess on any license master in a distributed or search head cluster environment. If a search head in your environment is also a license master, the license master components are installed when you install ITSI on the search heads.
NEW QUESTION 34
What are valid considerations when designing an ITSI Service? (Choose all that apply.)
- A. Backfill of a KPI should always be selected so historical data points can be used immediately and alerts based on that data can occur.
- B. Services, entities, and saved searches are stored in the ITSI app, while events created by KPI execution are stored in the itsi_summary index.
- C. Entities, entity meta-data, and entity rules should be planned carefully to support the service design and configuration.
- D. Service access control requirements for ITSI Team Access should be considered, and appropriate teams provisioned prior to creating the ITSI Service.
Answer: B,D
NEW QUESTION 35
When installing ITSI to support a Distributed Search Architecture, which of the following items apply?
(Choose all that apply.)
- A. Copy SA-IndexCreation to all indexers.
- B. Extract installer package into etc/apps directory of the cluster deployer node.
- C. Extract ITSI app package into etc/apps directory of search head.
- D. Copy SA-IndexCreation to the etc/apps directory on the index cluster master node.
Answer: A
Explanation:
Explanation
Copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on all individual indexers in your environment.
NEW QUESTION 36
Which of the following is a good use case regarding defining entities for a service?
- A. KPI total values are aggregated from multiple different category values in the source events.
- B. Automatically associate entities to services using multiple entity aliases.
- C. All of the entities have the same identifying field name.
- D. Being able to split a CPU usage KPI by host name.
Answer: B
Explanation:
Explanation
Define entities before creating services. When you configure a service, you can specify entity matching rules based on entity aliases that automatically add the entities to your service.
NEW QUESTION 37
When must a service define entity rules?
- A. If the intention is for the KPIs in the service to have different aggregate vs. entity KPI values.
- B. If the intention is for the KPIs in the service to filter to only entities assigned to the service.
- C. If some or all of the KPIs in the service will be split by entity.
- D. To enable entity cohesion anomaly detection.
Answer: B
Explanation:
Explanation
Provide a value to filter the service to a specific set of entities. These entity rule values are meant to be custom for each service.
NEW QUESTION 38
Which of the following is a recommended best practice for service and glass table design?
- A. Start with base searches, then services, and then glass tables.
- B. Always use the standard icons for glass table widgets to improve portability.
- C. Design glass tables first to discover which KPIs are important.
- D. Plan and implement services first, then build detailed glass tables.
Answer: C
NEW QUESTION 39
Which glass table feature can be used to toggle displaying KPI values from more than one service on a single widget?
- A. Service dependencies.
- B. Service swapping.
- C. Ad-hoc search.
- D. Service templates.
Answer: C
NEW QUESTION 40
There are two departments using ITSI. Finance and Sales. Analysts in each department should not be allowed to see each other's services. What are the role configuration steps required to accomplish this?
- A. itoa_finance_admin, inherited from itoa_team_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.
- B. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.
- C. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.
- D. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_team_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.
Answer: B
NEW QUESTION 41
Which of the following describes enabling smart mode for an aggregation policy?
- A. Edit the notable event view, enable smart mode, select "fields", and click "Save"
- B. Edit the aggregation policy, enable smart mode, select fields to analyze, click "Save"
- C. Configure -> Policies -> Smart Mode -> Enable, select "fields", click "Save"
- D. Enable grouping in Notable Event Review, select "Smart Mode", select "fields", and click "Save"
Answer: C
Explanation:
Explanation
1. From the ITSI main menu, click Configuration > Notable Event Aggregation Policies.
2. Select a custom policy or the Default Policy.
3. Under Smart Mode grouping, enable Smart Mode.
4. Click Select fields. A dialog displays the fields found in your notable events from the last 24 hours.
NEW QUESTION 42
When creating a custom deep dive, what color are services/KPIs in maintenance mode within the topology view?
- A. Gear Icon
- B. Purple
- C. Blue
- D. Gray
Answer: D
Explanation:
Explanation
Services, entities, and KPIs that are fully or partially impacted by a maintenance window appear in a dark gray color on pages that display health scores, including service analyzers, service and entity details pages, glass tables, multi-KPI alerts, and deep dives.
NEW QUESTION 43
Which of the following is a best practice when configuring maintenance windows?
- A. Give the maintenance window a buffer, for example, 15 minutes before and after actual maintenance work.
- B. Disable any glass tables that reference a KPI that is part of an open maintenance window.
- C. Change the color of services and entities that are part of an open maintenance window in the service analyzer.
- D. Develop a strategy for configuring a service's notable event generation when the service's maintenance window is open.
Answer: A
Explanation:
Explanation
It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and after you start and stop your maintenance work.
NEW QUESTION 44
Within a correlation search, dynamic field values can be specified with what syntax?
- A. %fieldname%
- B. fieldname
- C. eval(fieldname)
- D. <fieldname /fieldname>
Answer: B
NEW QUESTION 45
Which of the following is a characteristic of base searches?
- A. The fewer KPIs that share a common base search, the more efficiency a base search provides, and anomaly detection is more efficient.
- B. Search expression, entity splitting rules, and thresholds are configured at the base search level.
- C. The base search will execute whether or not a KPI needs it.
- D. It is possible to filter to entities assigned to the service for calculating the metrics for the service's KPIs.
Answer: D
NEW QUESTION 46
Which ITSI functions generate notable events? (Choose all that apply.)
- A. KPI threshold breaches.
- B. KPI anomaly detection.
- C. Multi-KPI alert.
- D. Correlation search.
Answer: A,B,D
Explanation:
Explanation
After you configure KPI thresholds, you can set up alerts to notify you when aggregate KPI severities change.
ITSI generates notable events in Episode Review based on the alerting rules you configure.
Anomaly detection generates notable events when a KPI IT Service Intelligence (ITSI) deviates from an expected pattern.
Notable events are typically generated by a correlation search.
NEW QUESTION 47
Which index contains ITSI Episodes?
- A. itsi_summary
- B. itsi_tracked_alerts
- C. itsi_grouped_alerts
- D. itsi_notable_archive
Answer: D
NEW QUESTION 48
After a notable event has been closed, how long will the meta data for that event remain in the KV Store by default?
- A. 9 months.
- B. 1 year.
- C. 6 months.
- D. 3 months.
Answer: C
Explanation:
Explanation
By default, notable event metadata is archived after six months to keep the KV store from growing too large.
NEW QUESTION 49
......
Splunk SPLK-3002 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
Certification dumps - Splunk IT Service SPLK-3002 guides - 100% valid: https://www.dumpsfree.com/SPLK-3002-valid-exam.html
100% Pass Your SPLK-3002 Splunk IT Service Intelligence Certified Admin at First Attempt with DumpsFree: https://drive.google.com/open?id=1uVyUHlqbabw02n5uYM_aVmv5uGyAJPlN