Splunk SPLK-3002 Online Practice Questions and Exam Preparation

Splunk SPLK-3002 Online Questions & Answers

• Question 81:

  When installing ITSI to support a Distributed Search Architecture, which of the following items apply? (Choose all that apply.)

  A. Copy SA-IndexCreation to all indexers.
  B. Copy SA-IndexCreation to the etc/apps directory on the index cluster master node.
  C. Extract installer package into etc/apps directory of the cluster deployer node.
  D. Extract ITSI app package into etc/apps directory of search head.
  A. Copy SA-IndexCreation to all indexers.

• Question 82:

  To use Adaptive Threshholding, what is the minimum requirement for a set of KPI data?

  A. 14 days old.
  B. 7 days old.
  C. 30 days old.
  D. 10 days old.
  B. 7 days old.

• Question 83:

  Which of the following is a best practice for identifying the most effective services with which to start an iterative ITSI deployment?

  A. Only include KPIs if they will be used in multiple services.
  B. Analyze the business to determine the most critical services.
  C. Focus on low-level services.
  D. Define a large number of key services early.
  B. Analyze the business to determine the most critical services.

• Question 84:

  What are valid ITSI Glass Table editor capabilities? (Choose all that apply.)

  A. Creating glass tables.
  B. Correlation search creation.
  C. Service swapping configuration.
  D. Adding KPI metric lanes to glass tables.
  A. Creating glass tables.
  C. Service swapping configuration.
  D. Adding KPI metric lanes to glass tables.

• Question 85:

  What are valid considerations when designing an ITSI Service? (Choose all that apply.)

  A. Service access control requirements for ITSI Team Access should be considered, and appropriate teams provisioned prior to creating the ITSI Service.
  B. Entities, entity meta-data, and entity rules should be planned carefully to support the service design and configuration.
  C. Services, entities, and saved searches are stored in the ITSI app, while events created by KPI execution are stored in the itsi_summary index.
  D. Backfill of a KPI should always be selected so historical data points can be used immediately and alerts based on that data can occur.
  A. Service access control requirements for ITSI Team Access should be considered, and appropriate teams provisioned prior to creating the ITSI Service.
  B. Entities, entity meta-data, and entity rules should be planned carefully to support the service design and configuration.
  C. Services, entities, and saved searches are stored in the ITSI app, while events created by KPI execution are stored in the itsi_summary index.

• Question 86:

  ITSI Saved Search Scheduling is configured to use realtime_schedule = 0. Which statement is accurate about this configuration?

  A. If this value is set to 0, the scheduler bases its determination of the next scheduled search execution time on the current time.
  B. If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time.
  C. If this value is set to 0, the scheduler may skip scheduled execution periods.
  D. If this value is set to 0, the scheduler might skip some execution periods to make sure that the scheduler is executing the searches running over the most recent time range.
  B. If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time.

• Question 87:

  Where are KPI search results stored?

  A. The default index.
  B. KV Store.
  C. Output to a CSV lookup.
  D. The itsi_summary index.
  D. The itsi_summary index.

• Question 88:

  When troubleshooting KPI search performance, which search names in job activity identify base searches?

  A. Indicator - XXXX - Base Search
  B. Indicator - Shared - xxxx - ITSI Search
  C. Indicator - Base - xxxx - ITSI Search
  D. Indicator - Base - XXXX - Shared Search
  B. Indicator - Shared - xxxx - ITSI Search

• Question 89:

  Which is the least permissive role required to modify default deep dives?

  A. itoa_analyst
  B. admin
  C. power
  D. itoa_admin
  D. itoa_admin

• Question 90:

  Which of the following describes enabling smart mode for an aggregation policy?

  A. Configure ?gt; Policies ?gt; Smart Mode ?gt; Enable, select "fields", click "Save"
  B. Enable grouping in Notable Event Review, select "Smart Mode", select "fields", and click "Save"
  C. Edit the aggregation policy, enable smart mode, select fields to analyze, click "Save"
  D. Edit the notable event view, enable smart mode, select "fields", and click "Save"
  C. Edit the aggregation policy, enable smart mode, select fields to analyze, click "Save"