Splunk SPLK-3002 Online Practice Questions and Exam Preparation

Splunk SPLK-3002 Online Questions & Answers

• Question 11:

  Which of the following is a valid type of Multi-KPI Alert?

  A. Score over composite.
  B. Value over time.
  C. Status over time.
  D. Rise over run.
  B. Value over time.

• Question 12:

  Which of the following is part of setting up a new aggregation policy?

  A. Filtering criteria
  B. Policy version
  C. Review order
  D. Module rules
  A. Filtering criteria

• Question 13:

  For which ITSI function is it a best practice to use a 15-30 minute time buffer?

  A. Correlation searches.
  B. Adaptive thresholding.
  C. Maintenance windows
  D. Anomaly detection.
  B. Adaptive thresholding.

• Question 14:

  Which of the following describes a way to delete multiple duplicate entities in ITSI?

  A. Via c CSV upload.
  B. Via the entity lister page.
  C. Via a search using the | deleteentity command.
  D. All of the above.
  D. All of the above.

• Question 15:

  When must a service define entity rules?

  A. If the intention is for the KPIs in the service to filter to only entities assigned to the service.
  B. To enable entity cohesion anomaly detection.
  C. If some or all of the KPIs in the service will be split by entity.
  D. If the intention is for the KPIs in the service to have different aggregate vs. entity KPI values.
  A. If the intention is for the KPIs in the service to filter to only entities assigned to the service.

• Question 16:

  Which of the following can generate notable events?

  A. Through ad-hoc search results which get processed by adaptive thresholds.
  B. When two entity aliases have a matching value.
  C. Through scheduled correlation searches which link to their respective services.
  D. Manually selected using the Notable Event Review panel.
  C. Through scheduled correlation searches which link to their respective services.

• Question 17:

  Which of the following statements is accurate when using multiple policies?

  A. New policies are applied after the default policy.
  B. Policy processing is applied in a defined order.
  C. An event can be processed by only a single policy.
  D. New policies are applied before the default policy.
  B. Policy processing is applied in a defined order.

• Question 18:

  Anomaly detection can be enabled on which one of the following?

  A. KPI
  B. Multi-KPI alert
  C. Entity
  D. Service
  A. KPI

• Question 19:

  In which index are active notable events stored?

  A. itsi_notable_archive
  B. itsi_notable_audit
  C. itsi_tracked_alerts
  D. itsi_tracked_groups
  C. itsi_tracked_alerts

• Question 20:

  Which glass table feature can be used to toggle displaying KPI values from more than one service on a single widget?

  A. Service templates.
  B. Service dependencies.
  C. Ad-hoc search.
  D. Service swapping.
  D. Service swapping.