SPLK-3002 Dumps 2022 New Splunk SPLK-3002 Exam Questions [Q10-Q24] : Actual Test Materials : http://blog.actualtests4sure.com

NO.10 Within a correlation search, dynamic field values can be specified with what syntax?

fieldname

%fieldname%

eval(fieldname)

NO.11 Which of the following are the default ports that must be configured on Splunk to use ITSI?

SplunkWeb (8405), SplunkD (8519), and HTTP Collector (8628)

SplunkWeb (8089), SplunkD (8088), and HTTP Collector (8000)

SplunkWeb (8000), SplunkD (8089), and HTTP Collector (8088)

SplunkWeb (8088), SplunkD (8089), and HTTP Collector (8000)

NO.12 After a notable event has been closed, how long will the meta data for that event remain in the KV Store by default?

6 months.

9 months.

1 year.

3 months.

NO.13 Which capabilities are enabled through “teams”?

Teams allow searches against the itsi_summary index.

Teams restrict notable event alert actions.

Teams restrict searches against the itsi_notable_audit index.

Teams allow restrictions to service content in UI views.

NO.14 Which deep dive swim lane type does not require writing SPL?

Event lane.

Automatic lane.

Metric lane.

KPI lane.

NO.15 Which of the following is a good use case regarding defining entities for a service?

Automatically associate entities to services using multiple entity aliases.

All of the entities have the same identifying field name.

Being able to split a CPU usage KPI by host name.

KPI total values are aggregated from multiple different category values in the source events.

NO.16 Which of the following items apply to anomaly detection? (Choose all that apply.)

Use AD on KPIs that have an unestablished baseline of data points. This allows the ML pattern to perform it’s magic.

A minimum of 24 hours of data is needed for anomaly detection, and a minimum of 4 entities for cohesive analysis.

Anomaly detection automatically generates notable events when KPI data diverges from the pattern.

There are 3 types of anomaly detection supported in ITSI: adhoc, trending, and cohesive.

NO.17 When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?

SA-ITOA

ITSI app

All ITSI components

SA-ITSI-Licensechecker

NO.18 In maintenance mode, which features of KPIs still function?

KPI searches will execute but will be buffered until the maintenance window is over.

KPI searches still run during maintenance mode, but results go to itsi_maintenance_summary index.

New KPIs can be created, but existing KPIs are locked.

KPI calculations and threshold settings can be modified.

NO.19 Which index is used to store KPI values?

itsi_summary_metrics

itsi_metrics

itsi_service_health

itsi_summary

NO.20 Which of the following is the best use case for configuring a Multi-KPI Alert?

Comparing content between two notable events.

Using machine learning to evaluate when data falls outside of an expected pattern.

Comparing anomaly detection between two KPIs.

Raising an alert when one or more KPIs indicate an outage is occurring.

NO.21 Which glass table feature can be used to toggle displaying KPI values from more than one service on a single widget?

Service templates.

Service dependencies.

Ad-hoc search.

Service swapping.

NO.22 Which of the following describes a way to delete multiple duplicate entities in ITSI?

Via c CSV upload.

Via the entity lister page.

Via a search using the | deleteentity command.

All of the above.

NO.23 What is the default importance value for dependent services’ health scores?

11

1

Unassigned

10

NO.24 Where are KPI search results stored?

The default index.

KV Store.

Output to a CSV lookup.

The itsi_summary index.

SPLK-3002 Dumps 2022 New Splunk SPLK-3002 Exam Questions [Q10-Q24]

Splunk SPLK-3002 Exam Syllabus Topics: