Splunk IT Service SPLK-3002 Dumps | Updated Mar 11, 2022 - TrainingDumps
Master 2022 Latest The Questions Splunk IT Service and Pass SPLK-3002 Real Exam!
NEW QUESTION 29
What are valid considerations when designing an ITSI Service? (Choose all that apply.)
- A. Backfill of a KPI should always be selected so historical data points can be used immediately and alerts based on that data can occur.
- B. Services, entities, and saved searches are stored in the ITSI app, while events created by KPI execution are stored in the itsi_summary index.
- C. Entities, entity meta-data, and entity rules should be planned carefully to support the service design and configuration.
- D. Service access control requirements for ITSI Team Access should be considered, and appropriate teams provisioned prior to creating the ITSI Service.
Answer: B,D
NEW QUESTION 30
When must a service define entity rules?
- A. If the intention is for the KPIs in the service to have different aggregate vs. entity KPI values.
- B. If the intention is for the KPIs in the service to filter to only entities assigned to the service.
- C. If some or all of the KPIs in the service will be split by entity.
- D. To enable entity cohesion anomaly detection.
Answer: B
Explanation:
Explanation
Provide a value to filter the service to a specific set of entities. These entity rule values are meant to be custom for each service.
NEW QUESTION 31
How do you automatically restrict a KPI to only the entities in its service, and generate KPI values for each entity?
- A. Select "Yes" for both "Split by Entity" and "Filter to Entities in Service".
- B. Select "No" for "Split by Entity" and "Yes" for "Filter to Entities in Service".
- C. Select "Yes" for "Split by Entity" and "No" for "Filter to Entities in Service".
- D. Select "No" for both "Split by Entity" and "Filter to Entities in Service".
Answer: A
NEW QUESTION 32
In maintenance mode, which features of KPIs still function?
- A. KPI calculations and threshold settings can be modified.
- B. KPI searches will execute but will be buffered until the maintenance window is over.
- C. New KPIs can be created, but existing KPIs are locked.
- D. KPI searches still run during maintenance mode, but results go to itsi_maintenance_summary index.
Answer: B
Explanation:
Explanation
It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and after you start and stop your maintenance work. This gives the system an opportunity to catch up with the maintenance state and reduces the chances of ITSI generating false positives during maintenance operations.
NEW QUESTION 33
Which of the following items describe ITSI Deep Dive capabilities? (Choose all that apply.)
- A. Visualizing one or more Service KPIs values by time.
- B. Comparing swim lane values for a slice of time.
- C. Examining and comparing alert levels for KPIs in a service over time.
- D. Comparing a service's notable events over a time period.
Answer: A,B,C
NEW QUESTION 34
Which ITSI functions generate notable events? (Choose all that apply.)
- A. KPI threshold breaches.
- B. KPI anomaly detection.
- C. Multi-KPI alert.
- D. Correlation search.
Answer: A,B,D
Explanation:
Explanation
After you configure KPI thresholds, you can set up alerts to notify you when aggregate KPI severities change.
ITSI generates notable events in Episode Review based on the alerting rules you configure.
Anomaly detection generates notable events when a KPI IT Service Intelligence (ITSI) deviates from an expected pattern.
Notable events are typically generated by a correlation search.
NEW QUESTION 35
Which of the following is a good use case regarding defining entities for a service?
- A. KPI total values are aggregated from multiple different category values in the source events.
- B. Automatically associate entities to services using multiple entity aliases.
- C. All of the entities have the same identifying field name.
- D. Being able to split a CPU usage KPI by host name.
Answer: B
Explanation:
Explanation
Define entities before creating services. When you configure a service, you can specify entity matching rules based on entity aliases that automatically add the entities to your service.
NEW QUESTION 36
Which of the following is an advantage of using adaptive time thresholds?
- A. Automatically update thresholds daily to manage dynamic changes to KPI values.
- B. Automatically adjust KPI calculation to manage dynamic event data.
- C. Automatically adjust aggregation policy grouping to manage escalating severity.
- D. Automatically adjust correlation search thresholds to adjust sensitivity over time.
Answer: A
NEW QUESTION 37
Which of the following is the best use case for configuring a Multi-KPI Alert?
- A. Using machine learning to evaluate when data falls outside of an expected pattern.
- B. Raising an alert when one or more KPIs indicate an outage is occurring.
- C. Comparing anomaly detection between two KPIs.
- D. Comparing content between two notable events.
Answer: D
NEW QUESTION 38
Which of the following are deployment recommendations for ITSI? (Choose all that apply.)
- A. Deployments should use fastest possible disk arrays for indexers.
- B. Deployments require a dedicated ITSI search head.
- C. Deployments may increase the number of required indexers based on the number of KPI searches.
- D. Deployments often require an increase of hardware resources above base Splunk requirements.
Answer: B,C,D
Explanation:
Explanation
You might need to increase the hardware specifications of your own Enterprise Security deployment above the minimum hardware requirements depending on your environment.
Install Splunk Enterprise Security on a dedicated search head or search head cluster.
The Splunk platform uses indexers to scale horizontally. The number of indexers required in an Enterprise Security deployment varies based on the data volume, data type, retention requirements, search type, and search concurrency.
NEW QUESTION 39
Where are KPI search results stored?
- A. The default index.
- B. Output to a CSV lookup.
- C. The itsi_summary index.
- D. KV Store.
Answer: C
Explanation:
Explanation
Search results are processed, created, and written to the itsi_summary index via an alert action.
NEW QUESTION 40
In distributed search, which components need to be installed on instances other than the search head?
- A. SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
- B. SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
- C. SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
- D. SA-ITSI-Licensechecker on indexers.
Answer: C
Explanation:
Explanation
SA-IndexCreation is required on all indexers. For non-clustered, distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers.
NEW QUESTION 41
Within a correlation search, dynamic field values can be specified with what syntax?
- A. %fieldname%
- B. fieldname
- C. eval(fieldname)
- D. <fieldname /fieldname>
Answer: B
NEW QUESTION 42
When creating a custom deep dive, what color are services/KPIs in maintenance mode within the topology view?
- A. Gear Icon
- B. Purple
- C. Blue
- D. Gray
Answer: D
Explanation:
Explanation
Services, entities, and KPIs that are fully or partially impacted by a maintenance window appear in a dark gray color on pages that display health scores, including service analyzers, service and entity details pages, glass tables, multi-KPI alerts, and deep dives.
NEW QUESTION 43
Which index will contain useful error messages when troubleshooting ITSI issues?
- A. _introspection
- B. itsi_summary
- C. itsi_notable_audit
- D. _internal
Answer: D
NEW QUESTION 44
Which index contains ITSI Episodes?
- A. itsi_summary
- B. itsi_tracked_alerts
- C. itsi_grouped_alerts
- D. itsi_notable_archive
Answer: D
NEW QUESTION 45
......
Splunk SPLK-3002 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
| Topic 10 |
|
| Topic 11 |
|
| Topic 12 |
|
| Topic 13 |
|
A fully updated 2022 SPLK-3002 Exam Dumps exam guide from training expert TrainingDumps: https://vcecollection.trainingdumps.com/SPLK-3002-valid-vce-dumps.html
