QUESTION: 9

Which of the following is a characteristic of base searches?

Search expression, entity splitting rules, and thresholds are configured at the base search level.
It is possible to filter to entities assigned to the service for calculating the metrics for the service’s KPIs.
The fewer KPIs that share a common base search, the more efficiency a base search provides, and anomaly detection is more efficient.
The base search will execute whether or not a KPI needs it.

Answer(s): B

Reference:

https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/BaseSearch

Reveal Solution Next Question

QUESTION: 10

What are valid ITSI Glass Table editor capabilities? (Choose all that apply.)

Creating glass tables.
Correlation search creation.
Service swapping configuration.
Adding KPI metric lanes to glass tables.

Answer(s): A,C,D

Explanation:

Create a glass table to visualize and monitor the interrelationships and dependencies across your IT and business services. The service swapping settings are saved and apply the next time you open the glass table.

You can add metrics like KPIs, ad hoc searches, and service health scores that update in real time against a background that you design. Glass tables show real-time data generated by KPIs and services.

Reference:

https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/GTOverview
https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/ServiceSwap

Reveal Solution Next Question

QUESTION: 11

Which of the following is the best use case for configuring a Multi-KPI Alert?

Comparing content between two notable events.
Using machine learning to evaluate when data falls outside of an expected pattern.
Comparing anomaly detection between two KPIs.
Raising an alert when one or more KPIs indicate an outage is occurring.

Answer(s): A

Reference:

https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/MKA

Reveal Solution Next Question

QUESTION: 12

In distributed search, which components need to be installed on instances other than the search head?

SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
SA-ITSI-Licensechecker on indexers.

Answer(s): A

Explanation:

SA-IndexCreation is required on all indexers. For non-clustered, distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers.

Reference:

https://docs.splunk.com/Documentation/ITSI/4.10.2/Install/InstallDD

Reveal Solution Next Question

Free SPLK-3002 Exam Braindumps (page: 4)

QUESTION: 9

Reference:

QUESTION: 10

Explanation:

Reference:

QUESTION: 11

Reference:

QUESTION: 12

Explanation:

Reference:

SPLK-3002 Discussions & Posts