Updated Jul 02, 2022 Verified SPLK-3002 dumps Q&As – 100% Pass [Q27-Q48]

SPLK-3002 Splunk

admin • July 2, 2022

Updated Jul 02, 2022 Verified SPLK-3002 dumps Q&As – 100% Pass [Q27-Q48]

Rate this post

Updated Jul 02, 2022 Verified SPLK-3002 dumps Q&As – 100% Pass

New 2022 Latest Questions SPLK-3002 Dumps – Use Updated Splunk Exam

NEW QUESTION 27
Which of the following best describes a default deep dive?

It initially shows all the entity swim lanes.

It initially shows the health scores for all services.

It initially shows all of the KPIs for a selected service.

It initially shows the highest importance KPIs.

NEW QUESTION 28
In Episode Review, what is the result of clicking an episode’s Acknowledge button?

Assign the current user as owner.

Change status from New to Acknowledged.

Change status from New to In Progress and assign the current user as owner.

Change status from New to Acknowledged and assign the current user as owner.

Explanation
When an episode warrants investigation, the analyst acknowledges the episode, which moves the status from New to In Progress.

NEW QUESTION 29
What should be considered when onboarding data into a Splunk index, assuming that ITSI will need to use this data?

Use | stats functions in custom fields to prepare the data for KPI calculations.

Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data.

Make sure that all fields conform to CIM, then use the corresponding module to import related services.

Plan to build as many data models as possible for ITSI to leverage

NEW QUESTION 30
Which of the following are deployment recommendations for ITSI? (Choose all that apply.)

Deployments often require an increase of hardware resources above base Splunk requirements.

Deployments require a dedicated ITSI search head.

Deployments may increase the number of required indexers based on the number of KPI searches.

Deployments should use fastest possible disk arrays for indexers.

Explanation
You might need to increase the hardware specifications of your own Enterprise Security deployment above the minimum hardware requirements depending on your environment.
Install Splunk Enterprise Security on a dedicated search head or search head cluster.
The Splunk platform uses indexers to scale horizontally. The number of indexers required in an Enterprise Security deployment varies based on the data volume, data type, retention requirements, search type, and search concurrency.

NEW QUESTION 31
What are valid ITSI Glass Table editor capabilities? (Choose all that apply.)

Creating glass tables.

Correlation search creation.

Service swapping configuration.

Adding KPI metric lanes to glass tables.

Explanation
Create a glass table to visualize and monitor the interrelationships and dependencies across your IT and business services.
The service swapping settings are saved and apply the next time you open the glass table.
You can add metrics like KPIs, ad hoc searches, and service health scores that update in real time against a background that you design. Glass tables show real-time data generated by KPIs and services.

NEW QUESTION 32
Within a correlation search, dynamic field values can be specified with what syntax?

fieldname

%fieldname%

eval(fieldname)

NEW QUESTION 33
Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)

Ping a host.

Send email.

Include in RSS feed.

Run a script.

Explanation
Throttling applies to any correlation search alert type, including notable events and actions (RSS feed, email, run script, and ticketing).

NEW QUESTION 34
Which of the following describes a realistic troubleshooting workflow in ITSI?

Correlation Search -> Deep Dive -> Notable Event

Service Analyzer -> Notable Event Review -> Deep Dive

Service Analyzer -> Aggregation Policy -> Deep Dive

Correlation search -> KPI -> Aggregation Policy

NEW QUESTION 35
Which scenario would benefit most by implementing ITSI?

Monitoring of business services functionality.

Monitoring of system hardware.

Monitoring of system process statuses

Monitoring of retail sales metrics.

NEW QUESTION 36
There are two departments using ITSI. Finance and Sales. Analysts in each department should not be allowed to see each other’s services. What are the role configuration steps required to accomplish this?

itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.

itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_team_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.

itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.

itoa_finance_admin, inherited from itoa_team_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.

NEW QUESTION 37
Which index is used to store KPI values?

itsi_summary_metrics

itsi_metrics

itsi_service_health

itsi_summary

Explanation
The IT Service Intelligence (ITSI) metrics summary index, itsi_summary_metrics, is a metrics-based summary index that stores KPI data.

NEW QUESTION 38
After a notable event has been closed, how long will the meta data for that event remain in the KV Store by default?

6 months.

9 months.

1 year.

3 months.

Explanation
By default, notable event metadata is archived after six months to keep the KV store from growing too large.

NEW QUESTION 39
Which of the following applies when configuring time policies for KPI thresholds?

A person can only configure 24 policies, one for each hour of the day.

They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00

If a person expects a KPI to change significantly through a cycle on a daily basis, don’t use it.

It is possible for multiple time policies to overlap.

Explanation
If you’re creating multiple time policies that require the same threshold values, you can save time by copying the threshold levels and their corresponding values from one policy to another.

NEW QUESTION 40
When creating a custom deep dive, what color are services/KPIs in maintenance mode within the topology view?

Gray

Purple

Gear Icon

Blue

Explanation
Services, entities, and KPIs that are fully or partially impacted by a maintenance window appear in a dark gray color on pages that display health scores, including service analyzers, service and entity details pages, glass tables, multi-KPI alerts, and deep dives.

NEW QUESTION 41
Which of the following is a valid type of Multi-KPI Alert?

Score over composite.

Value over time.

Status over time.

Rise over run.

NEW QUESTION 42
What is an episode?

A workflow task.

A deep dive.

A notable event group.

A notable event.

Explanation
It’s a deduplicated group of notable events occurring as part of a larger sequence, or an incident or period considered in isolation.

NEW QUESTION 43
Which of the following describes a way to delete multiple duplicate entities in ITSI?

Via c CSV upload.

Via the entity lister page.

Via a search using the | deleteentity command.

All of the above.

Explanation
Import entities from CSV files that contain one or more entity definitions. Importing entities from CSV files is an efficient way to define multiple entities.

NEW QUESTION 44
Which of the following items describe ITSI Backup and Restore functionality? (Choose all that apply.)

A pre-configured default ITSI backup job is provided that can be modified, but not deleted.

ITSI backup is inclusive of KV Store, ITSI Configurations, and index dependencies.

kvstore_to_json.py can be used in scripts or command line to backup ITSI for full or partial backups.

ITSI backups are stored as a collection of JSON formatted files.

Explanation
ITSI provides a kvstore_to_json.py script that lets you backup/restore ITSI configuration data, perform bulk service KPI operations, apply time zone offsets for ITSI objects, and regenerate KPI search schedules.
When you run a backup job, ITSI saves your data to a set of JSON files compressed into a single ZIP file.

NEW QUESTION 45
In distributed search, which components need to be installed on instances other than the search head?

SA-IndexCreation and SA-ITSI-Licensechecker on indexers.

SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.

SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.

SA-ITSI-Licensechecker on indexers.

Explanation
SA-IndexCreation is required on all indexers. For non-clustered, distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers.

NEW QUESTION 46
Which of the following items apply to anomaly detection? (Choose all that apply.)

Use AD on KPIs that have an unestablished baseline of data points. This allows the ML pattern to perform it’s magic.

A minimum of 24 hours of data is needed for anomaly detection, and a minimum of 4 entities for cohesive analysis.

Anomaly detection automatically generates notable events when KPI data diverges from the pattern.

There are 3 types of anomaly detection supported in ITSI: adhoc, trending, and cohesive.

NEW QUESTION 47
Which of the following items describe ITSI Deep Dive capabilities? (Choose all that apply.)

Comparing a service’s notable events over a time period.

Visualizing one or more Service KPIs values by time.

Examining and comparing alert levels for KPIs in a service over time.

Comparing swim lane values for a slice of time.

Loading …