[Jan-2022] Pass Splunk SPLK-3002 Tests Engine pdf - All Free Dumps
Splunk IT Service Intelligence Certified Admin Practice Tests 2022 | Pass SPLK-3002 with confidence!
NEW QUESTION 20
Which of the following items describe ITSI Backup and Restore functionality? (Choose all that apply.)
- A. ITSI backup is inclusive of KV Store, ITSI Configurations, and index dependencies.
- B. A pre-configured default ITSI backup job is provided that can be modified, but not deleted.
- C. kvstore_to_json.py can be used in scripts or command line to backup ITSI for full or partial backups.
- D. ITSI backups are stored as a collection of JSON formatted files.
Answer: C,D
Explanation:
Explanation
ITSI provides a kvstore_to_json.py script that lets you backup/restore ITSI configuration data, perform bulk service KPI operations, apply time zone offsets for ITSI objects, and regenerate KPI search schedules.
When you run a backup job, ITSI saves your data to a set of JSON files compressed into a single ZIP file.
NEW QUESTION 21
Which of the following is a best practice when configuring maintenance windows?
- A. Change the color of services and entities that are part of an open maintenance window in the service analyzer.
- B. Disable any glass tables that reference a KPI that is part of an open maintenance window.
- C. Develop a strategy for configuring a service's notable event generation when the service's maintenance window is open.
- D. Give the maintenance window a buffer, for example, 15 minutes before and after actual maintenance work.
Answer: D
Explanation:
Explanation
It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and after you start and stop your maintenance work.
NEW QUESTION 22
In Episode Review, what is the result of clicking an episode's Acknowledge button?
- A. Change status from New to Acknowledged and assign the current user as owner.
- B. Assign the current user as owner.
- C. Change status from New to Acknowledged.
- D. Change status from New to In Progress and assign the current user as owner.
Answer: D
Explanation:
Explanation
When an episode warrants investigation, the analyst acknowledges the episode, which moves the status from New to In Progress.
NEW QUESTION 23
After a notable event has been closed, how long will the meta data for that event remain in the KV Store by default?
- A. 1 year.
- B. 9 months.
- C. 6 months.
- D. 3 months.
Answer: C
Explanation:
Explanation
By default, notable event metadata is archived after six months to keep the KV store from growing too large.
NEW QUESTION 24
When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?
- A. SA-ITSI-Licensechecker
- B. ITSI app
- C. SA-ITOA
- D. All ITSI components
Answer: A
Explanation:
Explanation
Install SA-ITSI-Licensechecker and SA-UserAccess on any license master in a distributed or search head cluster environment. If a search head in your environment is also a license master, the license master components are installed when you install ITSI on the search heads.
NEW QUESTION 25
Within a correlation search, dynamic field values can be specified with what syntax?
- A. fieldname
- B. <fieldname /fieldname>
- C. %fieldname%
- D. eval(fieldname)
Answer: A
NEW QUESTION 26
How do you automatically restrict a KPI to only the entities in its service, and generate KPI values for each entity?
- A. Select "Yes" for both "Split by Entity" and "Filter to Entities in Service".
- B. Select "No" for both "Split by Entity" and "Filter to Entities in Service".
- C. Select "No" for "Split by Entity" and "Yes" for "Filter to Entities in Service".
- D. Select "Yes" for "Split by Entity" and "No" for "Filter to Entities in Service".
Answer: A
NEW QUESTION 27
Which index will contain useful error messages when troubleshooting ITSI issues?
- A. _internal
- B. itsi_summary
- C. _introspection
- D. itsi_notable_audit
Answer: A
NEW QUESTION 28
Which of the following is the best use case for configuring a Multi-KPI Alert?
- A. Raising an alert when one or more KPIs indicate an outage is occurring.
- B. Comparing content between two notable events.
- C. Comparing anomaly detection between two KPIs.
- D. Using machine learning to evaluate when data falls outside of an expected pattern.
Answer: B
NEW QUESTION 29
Which of the following is a best practice for identifying the most effective services with which to start an iterative ITSI deployment?
- A. Analyze the business to determine the most critical services.
- B. Only include KPIs if they will be used in multiple services.
- C. Define a large number of key services early.
- D. Focus on low-level services.
Answer: B
NEW QUESTION 30
Anomaly detection can be enabled on which one of the following?
- A. KPI
- B. Service
- C. Multi-KPI alert
- D. Entity
Answer: A
Explanation:
Explanation
Enable anomaly detection to identify trends and outliers in KPI search results that might indicate an issue with your system.
NEW QUESTION 31
Which of the following is a valid type of Multi-KPI Alert?
- A. Score over composite.
- B. Rise over run.
- C. Status over time.
- D. Value over time.
Answer: C
NEW QUESTION 32
What should be considered when onboarding data into a Splunk index, assuming that ITSI will need to use this data?
- A. Plan to build as many data models as possible for ITSI to leverage
- B. Use | stats functions in custom fields to prepare the data for KPI calculations.
- C. Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data.
- D. Make sure that all fields conform to CIM, then use the corresponding module to import related services.
Answer: C
NEW QUESTION 33
When installing ITSI to support a Distributed Search Architecture, which of the following items apply?
(Choose all that apply.)
- A. Copy SA-IndexCreation to the etc/apps directory on the index cluster master node.
- B. Extract ITSI app package into etc/apps directory of search head.
- C. Copy SA-IndexCreation to all indexers.
- D. Extract installer package into etc/apps directory of the cluster deployer node.
Answer: C
Explanation:
Explanation
Copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on all individual indexers in your environment.
NEW QUESTION 34
Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)
- A. Run a script.
- B. Send email.
- C. Include in RSS feed.
- D. Ping a host.
Answer: A,B,C
Explanation:
Explanation
Throttling applies to any correlation search alert type, including notable events and actions (RSS feed, email, run script, and ticketing).
NEW QUESTION 35
......
Online Exam Practice Tests with detailed explanations!: https://examcollection.actualcollection.com/SPLK-3002-exam-questions.html