Free Splunk IT Service Intelligence Certified Admin Exam SPLK-3002 Exam Practice Test

Which is the least permissive role required to modify default deep dives?

• itoa_analyst
• admin
• power
• itoa_admin

Which views would help an analyst identify that a memory usage KPI is going critical? (select all that apply)

• Memory KPI in a glass table.
• Memory panel of the OS Host Details view in the Operating System module.
• Memory swim lane in a Deep Dive.
• Service & KPI tiles in the Service Analyzer.

When in maintenance mode, which of the following is accurate?

• Once the window is over, KPIs and notable events will begin to be generated again.
• KPIs are shown in blue while in maintenance mode.
• Maintenance mode slots are scheduled on a per hour basis.
• Service health scores and KPI events are deleted until the window is over.

Which of the following describes a realistic troubleshooting workflow in ITSI?

• Correlation Search --> Deep Dive --> Notable Event
• Service Analyzer --> Notable Event Review --> Deep Dive
• Service Analyzer --> Aggregation Policy --> Deep Dive
• Correlation search --> KPI --> Aggregation Policy

Which of the following is a problem requiring correction in ITSI?

• Two or more entities with the same service ID.
• Two or more entities with the same entity ID.
• Two or more entities with the same value in a single alias field.
• Two or more entities with the same entity key value in any info field.

Where are KPI search results stored?

• The default index.
• KV Store.
• Output to a CSV lookup.
• The itsi_summary index.

Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)

• Ping a host.
• Send email.
• Include in RSS feed.
• Run a script.

How should entities be handled during the data audit phase of requirements gathering?

• Entity meta-data for info and aliases should be identified and recorded as requirements.
• Entities should be noted based upon Service KPI requirements such as 'by host' or 'by product line'.
• Entities must be identified for every Service KPI defined and recorded in requirements.
• Entities identified should be included in the entity filtering requirements, such as 'by processld' or 'by host'.

When changing a service template, which of the following will be added to linked services by default?

• Thresholds.
• Entity Rules.
• New KPIs.
• Health score.

Which of the following accurately describes base searches used for KPIs in a service?

• Base searches can be used for multiple services.
• A base search can only be used by its service and all dependent services.
• All the metrics in a base search are used by one service.
• All the KPIs in a service use the same base search.