Splunk SPLK-3002 Splunk IT Service Intelligence Certified Admin Exam Online Training

Question #11

Which of the following is the best use case for configuring a Multi-KPI Alert?

A . Comparing content between two notable events.
B . Using machine learning to evaluate when data falls outside of an expected pattern.
C . Comparing anomaly detection between two KPIs.
D . Raising an alert when one or more KPIs indicate an outage is occurring.

Reveal Solution Hide Solution

Question #12

In distributed search, which components need to be installed on instances other than the search head?

A . SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
B . SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
C . SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
D . SA-ITSI-Licensechecker on indexers.

Reveal Solution Hide Solution

Question #13

When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?

A . SA-ITOA
B . ITSI app
C . All ITSI components
D . SA-ITSI-Licensechecker

Reveal Solution Hide Solution

Question #14

Which of the following describes entities? (Choose all that apply.)

A . Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.
B . An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.
C . Multiple entities can share the same alias value, but must have different role values.
D . To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in Service”.

Reveal Solution Hide Solution

Question #15

Which of the following describes a realistic troubleshooting workflow in ITSI?

A . Correlation Search C> Deep Dive C> Notable Event
B . Service Analyzer C> Notable Event Review C> Deep Dive
C . Service Analyzer C> Aggregation Policy C> Deep Dive
D . Correlation search C> KPI C> Aggregation Policy

Reveal Solution Hide Solution

Question #16

Which of the following accurately describes base searches used for KPIs in a service?

A . Base searches can be used for multiple services.
B . A base search can only be used by its service and all dependent services.
C . All the metrics in a base search are used by one service.
D . All the KPIs in a service use the same base search.

Reveal Solution Hide Solution

Question #17

Which scenario would benefit most by implementing ITSI?

A . Monitoring of business services functionality.
B . Monitoring of system hardware.
C . Monitoring of system process statuses
D . Monitoring of retail sales metrics.

Reveal Solution Hide Solution

Question #18

ITSI Saved Search Scheduling is configured to use realtime_schedule = 0.

Which statement is accurate about this configuration?

A . If this value is set to 0, the scheduler bases its determination of the next scheduled search execution time on the current time.
B . If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time.
C . If this value is set to 0, the scheduler may skip scheduled execution periods.
D . If this value is set to 0, the scheduler might skip some execution periods to make sure that the scheduler is executing the searches running over the most recent time range.

Reveal Solution Hide Solution

Question #19

What effects does the KPI importance weight of 11 have on the overall health score of a service?

A . At least 10% of the KPIs will go critical.
B . Importance weight is unused for health scoring.
C . The service will go critical.
D . It is a minimum health indicator KPI.

Reveal Solution Hide Solution

Question #20

Which of the following is an advantage of using adaptive time thresholds?

A . Automatically update thresholds daily to manage dynamic changes to KPI values.
B . Automatically adjust KPI calculation to manage dynamic event data.
C . Automatically adjust aggregation policy grouping to manage escalating severity.
D . Automatically adjust correlation search thresholds to adjust sensitivity over time.

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/TimePolicies

Adaptive thresholds are thresholds calculated by machine learning algorithms that dynamically adapt and change based on the KPI’s observed behavior. Adaptive thresholds are useful for monitoring KPIs that have unpredictable or seasonal patterns that are difficult to capture with static thresholds .

For example, you might use adaptive thresholds for a KPI that measures web traffic volume, which can vary depending on factors such as holidays, promotions, events, and so on. The advantage of using adaptive thresholds is:

A) Automatically update thresholds daily to manage dynamic changes to KPI values. This is true because adaptive thresholds use historical data from a training window to generate threshold values for each time block in a threshold template. Each night at midnight, ITSI recalculates adaptive threshold values for a KPI by organizing the data from the training window into distinct buckets and then analyzing each bucket separately. This way, the thresholds reflect the most recent changes in the KPI data and account for any anomalies or trends.

The other options are not advantages of using adaptive thresholds because:

B) Automatically adjust KPI calculation to manage dynamic event data. This is not true because adaptive thresholds do not affect the KPI calculation, which is based on the base search and the aggregation method. Adaptive thresholds only affect the threshold values that are used to determine the KPI severity level.

C) Automatically adjust aggregation policy grouping to manage escalating severity. This is not true

because adaptive thresholds do not affect the aggregation policy, which is a set of rules that determines how to group notable events into episodes. Adaptive thresholds only affect the threshold values that are used to generate notable events based on KPI severity level.

D) Automatically adjust correlation search thresholds to adjust sensitivity over time. This is not true because adaptive thresholds do not affect the correlation search, which is a search that looks for relationships between data points and generates notable events. Adaptive thresholds only affect the threshold values that are used by KPIs, which can be used as inputs for correlation searches.

Reference: Create adaptive KPI thresholds in ITSI