SPLK-3002 Practice Test

SPLK-3002 Practice Test practice questions, page 3 of 4, with answer review and explanations.

Question 11

Which of the following is the best use case for configuring a Multi-KPI Alert?

  1. Comparing content between two notable events.
  2. Using machine learning to evaluate when data falls outside of an expected pattern.
  3. Comparing anomaly detection between two KPIs.
  4. Raising an alert when one or more KPIs indicate an outage is occurring.

Question 12

In distributed search, which components need to be installed on instances other than the search head?

  1. SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
  2. SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
  3. SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
  4. SA-ITSI-Licensechecker on indexers.

Question 13

When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?

  1. SA-ITOA
  2. ITSI app
  3. All ITSI components
  4. SA-ITSI-Licensechecker

Question 14

Which of the following describes entities? (Choose all that apply.)

  1. Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.
  2. An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.
  3. Multiple entities can share the same alias value, but must have different role values.
  4. To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in Service”.

Question 15

Which of the following describes a realistic troubleshooting workflow in ITSI?

  1. Correlation Search –> Deep Dive –> Notable Event
  2. Service Analyzer –> Notable Event Review –> Deep Dive
  3. Service Analyzer –> Aggregation Policy –> Deep Dive
  4. Correlation search –> KPI –> Aggregation Policy