[Mar 02, 2022] Get to the Top with SPLK-3002 Practice Exam Questions
Use Real SPLK-3002 Dumps Free Sample Questions and Practice Test Engine
Splunk SPLK-3002 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
| Topic 10 |
|
| Topic 11 |
|
| Topic 12 |
|
| Topic 13 |
|
| Topic 14 |
|
NEW QUESTION 17
What is the default importance value for dependent services' health scores?
- A. 0
- B. 1
- C. 2
- D. Unassigned
Answer: B
Explanation:
Explanation
By default, impacting service health scores have an importance value of 11.
NEW QUESTION 18
Which of the following items apply to anomaly detection? (Choose all that apply.)
- A. Use AD on KPIs that have an unestablished baseline of data points. This allows the ML pattern to perform it's magic.
- B. A minimum of 24 hours of data is needed for anomaly detection, and a minimum of 4 entities for cohesive analysis.
- C. Anomaly detection automatically generates notable events when KPI data diverges from the pattern.
- D. There are 3 types of anomaly detection supported in ITSI: adhoc, trending, and cohesive.
Answer: B,C
NEW QUESTION 19
Which scenario would benefit most by implementing ITSI?
- A. Monitoring of system hardware.
- B. Monitoring of retail sales metrics.
- C. Monitoring of system process statuses
- D. Monitoring of business services functionality.
Answer: D
NEW QUESTION 20
When changing a service template, which of the following will be added to linked services by default?
- A. Thresholds.
- B. Health score.
- C. New KPIs.
- D. Entity Rules.
Answer: D
Explanation:
Explanation
Link multiple services to a service template to manage them collectively in IT Service Intelligence (ITSI). A service can only be linked to one service template at a time. When you link a service to a service template, any existing KPIs in the service are preserved and KPIs in the template are added to the service. You can choose to append, replace, or keep entity rules.
NEW QUESTION 21
What should be considered when onboarding data into a Splunk index, assuming that ITSI will need to use this data?
- A. Use | stats functions in custom fields to prepare the data for KPI calculations.
- B. Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data.
- C. Plan to build as many data models as possible for ITSI to leverage
- D. Make sure that all fields conform to CIM, then use the corresponding module to import related services.
Answer: B
NEW QUESTION 22
Which of the following describes a way to delete multiple duplicate entities in ITSI?
- A. Via the entity lister page.
- B. Via a search using the | deleteentity command.
- C. Via c CSV upload.
- D. All of the above.
Answer: C
Explanation:
Explanation
Import entities from CSV files that contain one or more entity definitions. Importing entities from CSV files is an efficient way to define multiple entities.
NEW QUESTION 23
What is the main purpose of the service analyzer?
- A. Trigger external alerts based on threshold violations.
- B. Monitor overall Service and KPI status.
- C. Allow Analysts to add comments to Alerts.
- D. Display a list of All Services and Entities.
Answer: C
NEW QUESTION 24
Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)
- A. Ping a host.
- B. Send email.
- C. Run a script.
- D. Include in RSS feed.
Answer: B,C,D
Explanation:
Explanation
Throttling applies to any correlation search alert type, including notable events and actions (RSS feed, email, run script, and ticketing).
NEW QUESTION 25
Which of the following are deployment recommendations for ITSI? (Choose all that apply.)
- A. Deployments should use fastest possible disk arrays for indexers.
- B. Deployments require a dedicated ITSI search head.
- C. Deployments may increase the number of required indexers based on the number of KPI searches.
- D. Deployments often require an increase of hardware resources above base Splunk requirements.
Answer: B,C,D
Explanation:
Explanation
You might need to increase the hardware specifications of your own Enterprise Security deployment above the minimum hardware requirements depending on your environment.
Install Splunk Enterprise Security on a dedicated search head or search head cluster.
The Splunk platform uses indexers to scale horizontally. The number of indexers required in an Enterprise Security deployment varies based on the data volume, data type, retention requirements, search type, and search concurrency.
NEW QUESTION 26
Which of the following describes enabling smart mode for an aggregation policy?
- A. Edit the notable event view, enable smart mode, select "fields", and click "Save"
- B. Edit the aggregation policy, enable smart mode, select fields to analyze, click "Save"
- C. Configure -> Policies -> Smart Mode -> Enable, select "fields", click "Save"
- D. Enable grouping in Notable Event Review, select "Smart Mode", select "fields", and click "Save"
Answer: C
Explanation:
Explanation
1. From the ITSI main menu, click Configuration > Notable Event Aggregation Policies.
2. Select a custom policy or the Default Policy.
3. Under Smart Mode grouping, enable Smart Mode.
4. Click Select fields. A dialog displays the fields found in your notable events from the last 24 hours.
NEW QUESTION 27
Where are KPI search results stored?
- A. The default index.
- B. Output to a CSV lookup.
- C. The itsi_summary index.
- D. KV Store.
Answer: C
Explanation:
Explanation
Search results are processed, created, and written to the itsi_summary index via an alert action.
NEW QUESTION 28
Which of the following is an advantage of using adaptive time thresholds?
- A. Automatically update thresholds daily to manage dynamic changes to KPI values.
- B. Automatically adjust KPI calculation to manage dynamic event data.
- C. Automatically adjust aggregation policy grouping to manage escalating severity.
- D. Automatically adjust correlation search thresholds to adjust sensitivity over time.
Answer: A
NEW QUESTION 29
Which deep dive swim lane type does not require writing SPL?
- A. KPI lane.
- B. Metric lane.
- C. Automatic lane.
- D. Event lane.
Answer: C
Explanation:
Explanation
Among all the search configurations, automatic lane doesn't need to be written in Splunk Processing language.
NEW QUESTION 30
When in maintenance mode, which of the following is accurate?
- A. Once the window is over, KPIs and notable events will begin to be generated again.
- B. KPIs are shown in blue while in maintenance mode.
- C. Service health scores and KPI events are deleted until the window is over.
- D. Maintenance mode slots are scheduled on a per hour basis.
Answer: A
NEW QUESTION 31
Which of the following accurately describes base searches used for KPIs in a service?
- A. All the metrics in a base search are used by one service.
- B. Base searches can be used for multiple services.
- C. A base search can only be used by its service and all dependent services.
- D. All the KPIs in a service use the same base search.
Answer: B
Explanation:
Explanation
KPI base searches let you share a search definition across multiple KPIs in IT Service Intelligence (ITSI).
Create base searches to consolidate multiple similar KPIs, reduce search load, and improve search performance.
NEW QUESTION 32
Which of the following items describe ITSI Deep Dive capabilities? (Choose all that apply.)
- A. Visualizing one or more Service KPIs values by time.
- B. Comparing swim lane values for a slice of time.
- C. Examining and comparing alert levels for KPIs in a service over time.
- D. Comparing a service's notable events over a time period.
Answer: A,B,C
NEW QUESTION 33
How do you automatically restrict a KPI to only the entities in its service, and generate KPI values for each entity?
- A. Select "Yes" for both "Split by Entity" and "Filter to Entities in Service".
- B. Select "No" for "Split by Entity" and "Yes" for "Filter to Entities in Service".
- C. Select "Yes" for "Split by Entity" and "No" for "Filter to Entities in Service".
- D. Select "No" for both "Split by Entity" and "Filter to Entities in Service".
Answer: A
NEW QUESTION 34
......
Pass Splunk SPLK-3002 exam - questions - convert Tets Engine to PDF: https://www.actualtestsit.com/Splunk/SPLK-3002-exam-prep-dumps.html
2022 Realistic Verified Free Splunk SPLK-3002 Exam Questions: https://drive.google.com/open?id=1KAmcxNDKjzpKd8TZb-FkvgOqSOBjrIKN