Which of the following items describe ITSI Deep Dive capabilities? (Choose all that apply.)
Answer(s): B,C,D
https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/DeepDives A deep dive is a dashboard that allows you to analyze the historical trends and anomalies of your KPIs and metrics in ITSI. A deep dive displays a timeline of events and swim lanes of data that you can customize and filter to investigate issues and perform root cause analysis. Some of the capabilities of deep dives are:B) Visualizing one or more service KPIs values by time. This is true because you can add KPI swim lanes to a deep dive to show the values and severity levels of one or more KPIs over time. You can also compare KPIs from different services or entities using service swapping or entity splitting. C) Examining and comparing alert levels for KPIs in a service over time. This is true because you can add alert swim lanes to a deep dive to show the alert levels and counts for one or more KPIs over time. You can also drill down into the alert details and view the notable events associated with each alert.D) Comparing swim lane values for a slice of time. This is true because you can use the time range selector to zoom in or out of a specific time range in a deep dive. You can also use the time brush to select a slice of time and compare the swim lane values for that time period. The other option is not a capability of deep dives because:A) Comparing a service's notable events over a time period. This is not true because deep dives do not display notable events, which are alerts generated by ITSI based on certain conditions or correlations. Notable events are displayed in other dashboards, such as episode review or glass tables. [Overview of deep dives in ITSI], [Add swim lanes to a deep dive in ITSI]
What is an episode?
Answer(s): C
It's a deduplicated group of notable events occurring as part of a larger sequence, or an incident or period considered in isolation.
https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/EpisodeOverview An episode is a deduplicated group of notable events occurring as part of a larger sequence, or an incident or period considered in isolation. An episode helps you reduce alert noise and focus on the most important issues affecting your IT services. An episode is created by an aggregation policy, which is a set of rules that determines how to group notable events based on certain criteria, such as severity, source, title, and so on. You can use episode review to view, manage, and resolve episodes in ITSI. The statement that defines an episode is:C) A notable event group. This is true because an episode is composed of one or more notable events that are related by some common factor.The other options are not definitions of an episode because:A) A workflow task. This is not true because a workflow task is an action that you can perform on an episode, such as assigning an owner, changing the status, adding comments, and so on. B) A deep dive. This is not true because a deep dive is a dashboard that allows you to analyze the historical trends and anomalies of your KPIs and metrics in ITSI. D) A notable event. This is not true because a notable event is an alert generated by ITSI based on certain conditions or correlations, not a group of alerts. [Overview of Episode Review in ITSI], [Overview of aggregation policies in ITSI]
Which index will contain useful error messages when troubleshooting ITSI issues?
Answer(s): B
https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/TroubleshootRE The index that will contain useful error messages when troubleshooting ITSI issues is:B) _internal. This is true because the _internal index contains logs and metrics generated by Splunk processes, such as splunkd and metrics.log. These logs can help you diagnose problems with your Splunk environment, including ITSI components and features. The other indexes will not contain useful error messages because:A) _introspection. This is not true because the _introspection index contains data about Splunk resource usage, such as CPU, memory, disk space, and so on. These data can help you monitor the performance and health of your Splunk environment, but not the error messages. C) itsi_summary. This is not true because the itsi_summary index contains summarized data for your KPIs and services, such as health scores, severity levels, threshold values, and so on. These data can help you analyze the trends and anomalies of your IT services, but not the error messages. D) itsi_notable_audit. This is not true because the itsi_notable_audit index contains audit data for your notable events and episodes, such as creation time, owner
Which of the following is a recommended best practice for service and glass table design?
Answer(s): A
https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/GTOverviewA is the correct answer because it is recommended to plan and implement services first, then build detailed glass tables that reflect the service hierarchy and dependencies. This way, you can ensure that your glass tables provide accurate and meaningful service-level insights. Building glass tables first might lead to unnecessary or irrelevant KPIs that do not align with your service goals.Splunk IT Service Intelligence Service Design Best Practices
Which of the following are deployment recommendations for ITSI? (Choose all that apply.)
Answer(s): A,B,C
You might need to increase the hardware specifications of your own Enterprise Security deployment above the minimum hardware requirements depending on your environment. Install Splunk Enterprise Security on a dedicated search head or search head cluster. The Splunk platform uses indexers to scale horizontally. The number of indexers required in an Enterprise Security deployment varies based on the data volume, data type, retention requirements, search type, and search concurrency.
https://docs.splunk.com/Documentation/ES/latest/Install/DeploymentPlanning A, B, and C are correct answers because ITSI deployments often require more hardware resources than base Splunk requirements due to the high volume of data ingestion and processing. ITSI deployments also require a dedicated search head that runs the ITSI app and handles all ITSI-related searches and dashboards. ITSI deployments may also increase the number of required indexers based on the number and frequency of KPI searches, which can generate a large amount of summary data. ITSI deployment overview, ITSI deployment planning
Post your Comments and Discuss Splunk SPLK-3002 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-3002 content, but please register or login to continue.