Free Splunk IT Service Intelligence Certified Admin Exam SPLK-3002 Exam Practice Test

Which step is required to install ITSI on a single Search Head?

• Untar the ITSI package in /etc/apps
• Run splunk_apply shcluster-bundle
• Use the Splunk -> Manage Apps Dashboard to download and install.
• All of the above.

Which of the following is a recommended best practice for ITSI installation?

• ITSI should not be installed on search heads that have Enterprise Security installed.
• Before installing ITSI, make sure the Common Information Model (CIM) is installed.
• Install the Machine Learning Toolkit app if anomaly detection must be configured.
• Install ITSI on one search head in a search head cluster and migrate the configuration bundle to other search heads.

Which of the following statements is accurate when using multiple policies?

• New policies are applied after the default policy.
• Policy processing is applied in a defined order.
• An event can be processed by only a single policy.
• New policies are applied before the default policy.

What is the range for a normal Service Health score category?

• 20-40
• 40-60
• 60-80
• 80-100

Which of the following services often has KPIs but no entities?

• Security Service.
• Network Service.
• Business Service.
• Technical Service.

How do you automatically restrict a KPI to only the entities in its service, and generate KPI values for each entity?

• Select ''Yes'' for both ''Split by Entity'' and ''Filter to Entities in Service''.
• Select ''No'' for ''Split by Entity'' and ''Yes'' for ''Filter to Entities in Service''.
• Select ''Yes'' for ''Split by Entity'' and ''No'' for ''Filter to Entities in Service''.
• Select ''No'' for both ''Split by Entity'' and ''Filter to Entities in Service''.

When working with a notable event group in the Notable Events Review dashboard, which of the following can be set at the individual or group level?

• Service, status, owner.
• Severity, status, owner.
• Severity, comments, service.
• Severity, status, service.

Which anomaly detection algorithm is included within ITSI?

• Entity cohesion
• Standard deviation
• Linear regression
• Infantile regression

When troubleshooting KPI search performance, which search names in job activity identify base searches?

• Indicator - XXXX - Base Search
• Indicator - Shared - xxxx - ITSI Search
• Indicator - Base - xxxx - ITSI Search
• Indicator - Base - XXXX - Shared Search

Which of the following is a characteristic of notable event groups?

• Notable event groups combine independent notable events.
• Notable event groups are created in the itsi_tracked_alerts index.
• Notable event groups allow users to adjust threshold settings.
• All of the above.