Free SPLK-3002 sample questions

Correct answer: backup_itsi.py

The correct utility for backing up and restoring ITSI configurations is the `backup_itsi.py` script. This script is included with the ITSI installation and is specifically designed to export all ITSI-related KV Store collections and configuration files into a backup archive, which can later be used for restoration.

Correct answer: False

This statement is false. When a service is in maintenance mode, both its health score calculation is paused AND notable event generation for its KPIs is suppressed by default. This prevents false alarms and inaccurate health scores during planned maintenance periods.

Correct answers: Entity Filtering; Service Templates

Entity Filtering is crucial for differentiating between the instances. The service template's KPIs can be configured to filter on an entity alias, such as 'region'. When creating services from the template, the administrator can specify 'us' or 'eu' for the region, automatically scoping the KPIs to the correct set of microservice entities.

Service Templates are ideal for this scenario. A single template can be created for the 'checkout-service' with all its associated KPIs. This template can then be used to create multiple service instances, ensuring that monitoring is consistent across all regions.

Correct answer: 30 days

For anomaly detection to be effective, especially with strong seasonal patterns, Splunk recommends a minimum of 30 days of historical data for training. This duration allows the machine learning algorithms to learn the daily and weekly patterns, establish a reliable baseline, and more accurately identify true anomalies rather than predictable peaks.

Correct answer: A KPI lane for CPU, a Metric lane for Connections, and an Event lane for Logs

This is the most effective combination. A KPI lane is best for displaying the historical trend of the 'DB CPU Utilization %' KPI. A Metric lane is appropriate for charting the ad-hoc metric of 'Active DB Connections'. An Event lane is specifically designed to display raw log events, allowing the admin to see the actual error messages from the database server at specific points in time, correlating them with the KPI and metric trends.

Correct answer: Create a new team, assign the `Online_Banking_Portal` service to the team with read permissions, and then assign the `Banking_Ops` role to that team.

This is the correct procedure for service-level access control in ITSI. Teams are the mechanism for assigning permissions to specific services. The correct workflow is: 1) Create a team (e.g., 'Banking Services Team'). 2) Assign the specific service (`Online_Banking_Portal`) to this team with 'read' permissions. 3) Assign the Splunk role (`Banking_Ops`) that contains the users to the newly created team. This ensures the users in that role only get the permissions defined for that team on that specific service.

Correct answers: Service Health Score; Single Value

The Service Health Score visualization is specifically designed for this purpose. It displays a service's health score as a colored shape (e.g., a hexagon or square), which is a common and effective way to represent overall status in a high-level monitoring view.

The Single Value visualization is excellent for NOC dashboards as it clearly displays the current health score or value of a critical KPI. Its color changes based on severity, providing an immediate visual cue of status (e.g., green, yellow, red).

Correct answer: As an entity alias

Configuring the `role` column as an entity alias is the correct approach. The entity title (`hostname`) is the primary identifier. An alias provides an additional, searchable key-value pair associated with the entity. This allows KPI searches to be filtered or split by the alias `role` (e.g., `role=webserver`).

Correct answer: To allow the health score of a downstream service to impact the health score of an upstream service.

The primary purpose of service dependencies is to model the relationships between services so that the health status of a foundational (downstream) service can propagate to and impact the health of a service that relies on it (upstream). This enables more accurate root cause analysis and impact assessment.

Correct answer: avg(response_time_ms)

In the KPI configuration, ITSI runs a base search first. The 'Search & Calculation' field expects only the statistical function to be applied to the results of the base search. Therefore, `avg(response_time_ms)` is the correct syntax. ITSI will automatically handle grouping the results over the 5-minute interval.