Which of the following describes a way to delete multiple duplicate entities in ITSI?
Answer(s): D
D is the correct answer because ITSI provides multiple ways to delete multiple duplicate entities. You can use a CSV upload to overwrite existing entities with new or updated information, or delete them by setting the action field to delete. You can also use the entity lister page to select multiple entities and delete them in bulk. Alternatively, you can use a search command called | deleteentity to delete entities that match certain criteria.
Create and update entities using a CSV file in ITSI, Delete entities in bulk in ITSI, Delete entities using the | deleteentity command in ITSI
Which capabilities are enabled through "teams"?
D is the correct answer because teams allow you to restrict access to service content in UI views such as service analyzers, glass tables, deep dives, and episode review. Teams also control access to services and KPIs for editing and viewing purposes. Teams do not affect the ability to search against the itsi_summary index, restrict notable event alert actions, or restrict searches against the itsi_notable_audit index.
Overview of teams in ITSI
Besides creating notable events, what are the default alert actions a correlation search can execute? (Choose all that apply.)
Answer(s): B,C,D
Throttling applies to any correlation search alert type, including notable events and actions (RSS feed, email, run script, and ticketing).
https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/ConfigCS B, C, and D are correct answers because they are the default alert actions that a correlation search can execute besides creating notable events. You can configure a correlation search to send an email, include the results in an RSS feed, or run a custom script when the search matches a defined pattern. Ping a host is not a default alert action for correlation searches.Configure correlation search settings in ITSI
Within a correlation search, dynamic field values can be specified with what syntax?
Answer(s): B
https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/Searchindexes B is the correct answer because dynamic field values can be specified with <fieldname /fieldname> syntax within a correlation search. This syntax allows you to insert values from fields returned by the correlation search into alert actions such as email subject or body. For example, <host /host> inserts the value of the host field into the email. [Use dynamic field values in correlation searches in ITSI]
In maintenance mode, which features of KPIs still function?
Answer(s): A
It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and after you start and stop your maintenance work. This gives the system an opportunity to catch up with the maintenance state and reduces the chances of ITSI generating false positives during maintenance operations.
https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/AboutMWA is the correct answer because KPI searches still run during maintenance mode, but the results are buffered until the maintenance window is over. This means that no alerts are triggered during maintenance mode, but once it ends, the buffered results are processed and alerts are generated if necessary. You cannot create new KPIs or modify existing KPIs during maintenance mode.[Overview of maintenance windows in ITSI]
Post your Comments and Discuss Splunk SPLK-3002 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-3002 content, but please register or login to continue.