The Best Splunk SPLK-3002 Study Guides and Dumps of 2021
Top Splunk SPLK-3002 Exam Audio Study Guide! Practice Questions Edition
Splunk SPLK-3002 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
| Topic 10 |
|
| Topic 11 |
|
| Topic 12 |
|
| Topic 13 |
|
| Topic 14 |
|
| Topic 15 |
|
NEW QUESTION 11
Which of the following items describe ITSI Deep Dive capabilities? (Choose all that apply.)
- A. Visualizing one or more Service KPIs values by time.
- B. Comparing swim lane values for a slice of time.
- C. Comparing a service's notable events over a time period.
- D. Examining and comparing alert levels for KPIs in a service over time.
Answer: A,B,D
NEW QUESTION 12
When changing a service template, which of the following will be added to linked services by default?
- A. New KPIs.
- B. Thresholds.
- C. Entity Rules.
- D. Health score.
Answer: C
Explanation:
Explanation
Link multiple services to a service template to manage them collectively in IT Service Intelligence (ITSI). A service can only be linked to one service template at a time. When you link a service to a service template, any existing KPIs in the service are preserved and KPIs in the template are added to the service. You can choose to append, replace, or keep entity rules.
NEW QUESTION 13
ITSI Saved Search Scheduling is configured to use realtime_schedule = 0. Which statement is accurate about this configuration?
- A. If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time.
- B. If this value is set to 0, the scheduler may skip scheduled execution periods.
- C. If this value is set to 0, the scheduler bases its determination of the next scheduled search execution time on the current time.
- D. If this value is set to 0, the scheduler might skip some execution periods to make sure that the scheduler is executing the searches running over the most recent time range.
Answer: A
Explanation:
Explanation
If set to 0, the scheduler determines the next scheduled search run time based on the last run time for the search. This is called continuous scheduling.
NEW QUESTION 14
Which of the following applies when configuring time policies for KPI thresholds?
- A. They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00
- B. If a person expects a KPI to change significantly through a cycle on a daily basis, don't use it.
- C. It is possible for multiple time policies to overlap.
- D. A person can only configure 24 policies, one for each hour of the day.
Answer: C
Explanation:
Explanation
If you're creating multiple time policies that require the same threshold values, you can save time by copying the threshold levels and their corresponding values from one policy to another.
NEW QUESTION 15
Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)
- A. Run a script.
- B. Include in RSS feed.
- C. Ping a host.
- D. Send email.
Answer: A,B,D
Explanation:
Explanation
Throttling applies to any correlation search alert type, including notable events and actions (RSS feed, email, run script, and ticketing).
NEW QUESTION 16
When must a service define entity rules?
- A. If some or all of the KPIs in the service will be split by entity.
- B. If the intention is for the KPIs in the service to filter to only entities assigned to the service.
- C. If the intention is for the KPIs in the service to have different aggregate vs. entity KPI values.
- D. To enable entity cohesion anomaly detection.
Answer: B
Explanation:
Explanation
Provide a value to filter the service to a specific set of entities. These entity rule values are meant to be custom for each service.
NEW QUESTION 17
Which ITSI functions generate notable events? (Choose all that apply.)
- A. KPI anomaly detection.
- B. Correlation search.
- C. Multi-KPI alert.
- D. KPI threshold breaches.
Answer: A,B,D
Explanation:
Explanation
After you configure KPI thresholds, you can set up alerts to notify you when aggregate KPI severities change.
ITSI generates notable events in Episode Review based on the alerting rules you configure.
Anomaly detection generates notable events when a KPI IT Service Intelligence (ITSI) deviates from an expected pattern.
Notable events are typically generated by a correlation search.
NEW QUESTION 18
Which of the following describes a realistic troubleshooting workflow in ITSI?
- A. Correlation search -> KPI -> Aggregation Policy
- B. Correlation Search -> Deep Dive -> Notable Event
- C. Service Analyzer -> Notable Event Review -> Deep Dive
- D. Service Analyzer -> Aggregation Policy -> Deep Dive
Answer: B
NEW QUESTION 19
Which of the following describes enabling smart mode for an aggregation policy?
- A. Edit the notable event view, enable smart mode, select "fields", and click "Save"
- B. Edit the aggregation policy, enable smart mode, select fields to analyze, click "Save"
- C. Enable grouping in Notable Event Review, select "Smart Mode", select "fields", and click "Save"
- D. Configure -> Policies -> Smart Mode -> Enable, select "fields", click "Save"
Answer: D
Explanation:
Explanation
1. From the ITSI main menu, click Configuration > Notable Event Aggregation Policies.
2. Select a custom policy or the Default Policy.
3. Under Smart Mode grouping, enable Smart Mode.
4. Click Select fields. A dialog displays the fields found in your notable events from the last 24 hours.
NEW QUESTION 20
When creating a custom deep dive, what color are services/KPIs in maintenance mode within the topology view?
- A. Gray
- B. Blue
- C. Gear Icon
- D. Purple
Answer: A
Explanation:
Explanation
Services, entities, and KPIs that are fully or partially impacted by a maintenance window appear in a dark gray color on pages that display health scores, including service analyzers, service and entity details pages, glass tables, multi-KPI alerts, and deep dives.
NEW QUESTION 21
Which of the following describes entities? (Choose all that apply.)
- A. An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.
- B. Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.
- C. Multiple entities can share the same alias value, but must have different role values.
- D. To automatically restrict the KPI to only the entities in a particular service, select "Filter to Entities in Service".
Answer: D
NEW QUESTION 22
In distributed search, which components need to be installed on instances other than the search head?
- A. SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
- B. SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
- C. SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
- D. SA-ITSI-Licensechecker on indexers.
Answer: B
Explanation:
Explanation
SA-IndexCreation is required on all indexers. For non-clustered, distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers.
NEW QUESTION 23
Which of the following are the default ports that must be configured on Splunk to use ITSI?
- A. SplunkWeb (8405), SplunkD (8519), and HTTP Collector (8628)
- B. SplunkWeb (8089), SplunkD (8088), and HTTP Collector (8000)
- C. SplunkWeb (8088), SplunkD (8089), and HTTP Collector (8000)
- D. SplunkWeb (8000), SplunkD (8089), and HTTP Collector (8088)
Answer: D
NEW QUESTION 24
Which scenario would benefit most by implementing ITSI?
- A. Monitoring of system hardware.
- B. Monitoring of business services functionality.
- C. Monitoring of system process statuses
- D. Monitoring of retail sales metrics.
Answer: B
NEW QUESTION 25
Which of the following is a recommended best practice for service and glass table design?
- A. Plan and implement services first, then build detailed glass tables.
- B. Design glass tables first to discover which KPIs are important.
- C. Start with base searches, then services, and then glass tables.
- D. Always use the standard icons for glass table widgets to improve portability.
Answer: B
NEW QUESTION 26
Which of the following is an advantage of using adaptive time thresholds?
- A. Automatically adjust KPI calculation to manage dynamic event data.
- B. Automatically adjust correlation search thresholds to adjust sensitivity over time.
- C. Automatically adjust aggregation policy grouping to manage escalating severity.
- D. Automatically update thresholds daily to manage dynamic changes to KPI values.
Answer: D
NEW QUESTION 27
Which of the following items describe ITSI Backup and Restore functionality? (Choose all that apply.)
- A. ITSI backups are stored as a collection of JSON formatted files.
- B. ITSI backup is inclusive of KV Store, ITSI Configurations, and index dependencies.
- C. A pre-configured default ITSI backup job is provided that can be modified, but not deleted.
- D. kvstore_to_json.py can be used in scripts or command line to backup ITSI for full or partial backups.
Answer: A,D
Explanation:
Explanation
ITSI provides a kvstore_to_json.py script that lets you backup/restore ITSI configuration data, perform bulk service KPI operations, apply time zone offsets for ITSI objects, and regenerate KPI search schedules.
When you run a backup job, ITSI saves your data to a set of JSON files compressed into a single ZIP file.
NEW QUESTION 28
Where are KPI search results stored?
- A. The default index.
- B. KV Store.
- C. Output to a CSV lookup.
- D. The itsi_summary index.
Answer: D
Explanation:
Explanation
Search results are processed, created, and written to the itsi_summary index via an alert action.
NEW QUESTION 29
Which of the following describes a way to delete multiple duplicate entities in ITSI?
- A. All of the above.
- B. Via c CSV upload.
- C. Via the entity lister page.
- D. Via a search using the | deleteentity command.
Answer: B
Explanation:
Explanation
Import entities from CSV files that contain one or more entity definitions. Importing entities from CSV files is an efficient way to define multiple entities.
NEW QUESTION 30
Which of the following best describes a default deep dive?
- A. It initially shows all the entity swim lanes.
- B. It initially shows the health scores for all services.
- C. It initially shows all of the KPIs for a selected service.
- D. It initially shows the highest importance KPIs.
Answer: A
NEW QUESTION 31
Which of the following items apply to anomaly detection? (Choose all that apply.)
- A. Anomaly detection automatically generates notable events when KPI data diverges from the pattern.
- B. Use AD on KPIs that have an unestablished baseline of data points. This allows the ML pattern to perform it's magic.
- C. A minimum of 24 hours of data is needed for anomaly detection, and a minimum of 4 entities for cohesive analysis.
- D. There are 3 types of anomaly detection supported in ITSI: adhoc, trending, and cohesive.
Answer: A,C
NEW QUESTION 32
......
Valid SPLK-3002 Exam Updates - 2021 Study Guide: https://www.exam4labs.com/SPLK-3002-practice-torrent.html
SPLK-3002 Certification - The Ultimate Guide: https://drive.google.com/open?id=1tY8wxDyLiJ-R9-bYrxRFaW6UbVNHzC3M