Splunk SPLK-3002 Practice Questions
Splunk IT Service Intelligence Certified Admin Exam
Order our SPLK-3002 Practice Questions Today and Get Ready to Pass with
Flying Colors!
SPLK-3002 Practice Exam Features | QuestionsTube
Latest & Updated Exam Questions
Subscribe to FREE Updates
Both PDF & Exam Engine
Download Directly Without Waiting
https://www.questionstube.com/exam/splk-3002/
At QuestionsTube, you can read SPLK-3002 free demo questions in pdf file, so
you can check the questions and answers before deciding to download the
Splunk SPLK-3002 practice questions. These free demo questions are parts of
the SPLK-3002 exam questions. Download and read them carefully, you will find
that the SPLK-3002 test questions of QuestionsTube will be your great learning
materials online. Share some SPLK-3002 exam online questions below.
1.Which of the following is the best use case for configuring a Multi-KPI Alert?
E
xa
m
Q
ue
st
io
ns
an
d
A
ns
w
er
s
A. Comparing content between two notable events.
B. Using machine learning to evaluate when data falls outside of an expected pattern.
C. Comparing anomaly detection between two KPIs.
D. Raising an alert when one or more KPIs indicate an outage is occurring.
Answer: D
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/MKA
A multi-KPI alert is a type of correlation search that is based on defined trigger conditions for two or
more KPIs. When trigger conditions occur simultaneously for each KPI, the search generates a
notable event .
For example, you might create a multi-KPI alert based on two common KPIs: CPU load percent and
web requests. A sudden simultaneous spike in both CPU load percent and web request KPIs might
indicate a DDOS (Distributed Denial of Service) attack. Multi-KPI alerts can bring such trending
behaviors to your attention early, so that you can take action to minimize any impact on performance.
Multi-KPI alerts are useful for correlating the status of multiple KPIs across multiple services. They
help you identify causal relationships, investigate root cause, and provide insights into behaviors
across your infrastructure. The best use case for configuring a multi-KPI alert is to raise an alert when
one or more KPIs indicate an outage is occurring, such as when the service health score drops below
a certain threshold or when multiple KPIs have critical severity levels.
Reference: Create multi-KPI alerts in ITSI
U
pd
at
ed
S
pl
un
k
S
P
LK
-3
00
2
P
ra
ct
i
ce
T
es
t
w
it
h
La
te
st
2.In distributed search, which components need to be installed on instances other than the search
head?
A. SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
B. SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the
license master.
C. SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
D. SA-ITSI-Licensechecker on indexers.
Answer: A
Explanation:
SA-IndexCreation is required on all indexers. For non-clustered, distributed environments, copy SAIndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Install/InstallDD
In distributed search, the components that need to be installed on instances other than the search
head are SA-IndexCreation and SA-ITSI-Licensechecker on indexers. SA-IndexCreation is an add-on
that creates the indexes required by ITSI, such as itsi_summary and itsi_tracked_alerts. SA-ITSILicensechecker is an add-on that monitors the license usage of ITSI and generates alerts when the
license limit is exceeded or about to expire. These components need to be installed on indexers
because they handle the data ingestion and storage functions for ITSI. The other components, such
as ITSI app and SA-ITOA, need to be installed on the search head(s) because they handle the search
management and presentation functions for ITSI.
Reference: Install IT Service Intelligence in a distributed environment
3.Which glass table feature can be used to toggle displaying KPI values from more than one service
on a single widget?
A. Service templates.
B. Service dependencies.
C. Ad-hoc search.
D. Service swapping.
Answer: D
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/Visualizations#collapseDesktop8 A
glass table is a visualization tool that allows you to monitor the interrelationships and dependencies
across your IT and business services. You can add metrics like KPIs, ad hoc searches, and service
health scores that update in real time against a background that you design. One of the features of
glass tables is service swapping, which enables you to toggle displaying KPI values from more than
one service on a single widget. You can use service swapping to compare metrics across different
services without creating multiple glass tables or widgets.
Reference: Overview of the glass table editor in ITSI, [Configure service swapping on glass tables]
w
it
h
La
te
st
E
xa
m
Q
ue
st
io
ns
an
d
A
ns
w
er
s
4.Which of the following is a recommended best practice for service and glass table design?
A. Plan and implement services first, then build detailed glass tables.
B. Always use the standard icons for glass table widgets to improve portability.
C. Start with base searches, then services, and then glass tables.
D. Design glass tables first to discover which KPIs are important.
Answer: A
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/GTOverview
A is the correct answer because it is recommended to plan and implement services first, then build
detailed glass tables that reflect the service hierarchy and dependencies. This way, you can ensure
that your glass tables provide accurate and meaningful service-level insights. Building glass tables
first might lead to unnecessary or irrelevant KPIs that do not align with your service goals.
Reference: Splunk IT Service Intelligence Service Design Best Practices
U
pd
at
ed
S
pl
un
k
S
P
LK
-3
00
2
P
ra
ct
i
ce
T
es
t
5.Which of the following accurately describes base searches used for KPIs in a service?
A. Base searches can be used for multiple services.
B. A base search can only be used by its service and all dependent services.
C. All the metrics in a base search are used by one service.
D. All the KPIs in a service use the same base search.
Answer: A
Explanation:
KPI base searches let you share a search definition across multiple KPIs in IT Service Intelligence
(ITSI). Create base searches to consolidate multiple similar KPIs, reduce search load, and improve
search performance.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/BaseSearch
A base search is a search definition that can be shared across multiple KPIs that use the same data
source. Base searches can improve search performance and reduce search load by consolidating
multiple similar KPIs.
The statement that accurately describes base searches used for KPIs in a service is:
A) Base searches can be used for multiple services. This means that you can create a base search
for a service and use it for other services that have similar data sources and KPIs .
For example, if you have multiple services that monitor web server performance, you can create a
base search that queries the web server logs and use it for all the services that need to calculate KPIs
based on those logs.
Powered by TCPDF (www.tcpdf.org)