Free Preparation Discussions
MENU
Splunk SPLK-3002 Exam Questions
- Topic 1: Identify What ITSI Does/ Describe Reasons for Using ITSI/ Examine the ITSI User Interface
- Topic 2: Glass Tables, Describe Glass Tables/ Use Glass Tables/ Design Glass Tables/ Configure Glass Tables
- Topic 3: Managing Notable Events/ Define Key Notable Events Terms and their Relationships/ Describe Examples of Multi-KPI Alerts
- Topic 4: Describe the Notable Events Workflow/ Work with Notable Events/ Investigating Issues with Deep Dives/ Describe Deep Dive Concepts and Their Relationships/ Describe Deep Dive Concepts and Their Relationships/ Use Default Deep Dives
- Topic 5: Create and Customize New Custom Deep Dives/ Add and Configure Swim Lanes/ Describe Effective Workflows for Troubleshooting
- Topic 6: Installing and Configuring ITSI/ List ITSI Hardware Recommendations/ Describe ITSI Deployment Options/ Identify ITSI Components
- Topic 7: Describe the Installation Procedure/ Identify Data Input Options for ITSI/ Add Custom Data to an ITSI Deployment
- Topic 8: Given Customer Requirements, Plan an ITSI Implementation/ Identify Site Entities/ Data Audit and Base Searches
- Topic 9: Use a Data Audit to Identify Service Key Performance Indicators/ Use a Service Design to Implement Services in ITSI/ Thresholds and Time Policies
- Topic 10: Create KPIs with Static and Adaptive Thresholds/ Use Time Policies to Define Flexible Thresholds/ Entities and Modules, Importing Entities
- Topic 11: Using Entities in KPI Searches/ Templates and Dependencies/ Use Templates to Manage Services/ Define Dependencies Between Services
- Topic 12: Anomaly Detection/ Enable Anomaly Detection/ Work with Generated Anomaly Events/ Correlation and Multi KPI Searches/ Define New Correlation Searches
- Topic 13: Define Multi KPI Alerts/ Manage Notable Event Storage/ Aggregation Policies/ Create New Aggregation Policies
- Topic 14: Configure User Access Control/ Create Service Level Teams/ Troubleshooting ITSI/ Backup and Restore/ Maintenance Mode, Creating Modules, Troubleshooting
Free Splunk SPLK-3002 Exam Actual Questions
Note: Premium Questions for SPLK-3002 were last updated On Apr. 30, 2026 (see below)
In which index are active notable events stored?
In Splunk IT Service Intelligence (ITSI), notable events are created and managed within the context of its Event Analytics framework. These notable events are stored in the itsi_tracked_alerts index. This index is specifically designed to hold the active notable events that are generated by ITSI's correlation searches, which are based on the conditions defined for various services and their KPIs. Notable events are essentially alerts or issues that need to be investigated and resolved. The itsi_tracked_alerts index enables efficient storage, querying, and management of these events, facilitating the ITSI's event management and review process. The other options, such as itsi_notable_archive and itsi_notable_audit, serve different purposes, such as archiving resolved notable events and auditing changes to notable event configurations, respectively. Therefore, the correct answer for where active notable events are stored is the itsi_tracked_alerts index.
When installing ITSI to support a Distributed Search Architecture, which of the following items apply? (Choose all that apply.)
CopySA-IndexCreationto$SPLUNK_HOME/etc/apps/on all individual indexers in your environment.
A is the correct answer because when installing ITSI to support a distributed search architecture, you need to copy SA-IndexCreation to all indexers. SA-IndexCreation is an app that contains the definitions of the ITSI indexes, such as itsi_summary, itsi_tracked_alerts, itsi_grouped_alerts, etc. You need to copy this app to all indexers to ensure that they can store and search the ITSI data. B is not a correct answer because you do not need to copy SA-IndexCreation to the etc/apps directory on the index cluster master node. The index cluster master node does not store or search data, it only manages the replication and availability of data across the index cluster peers. C is not a correct answer because you do not need to extract the installer package into etc/apps directory of the cluster deployer node. The cluster deployer node is used to distribute apps and configuration updates to the search head cluster members. You need to extract the installer package into etc/shcluster/apps directory of the cluster deployer node instead. D is not a correct answer because you do not need to extract the ITSI app package into etc/apps directory of search head. You need to extract the ITSI app package into etc/shcluster/apps directory of the cluster deployer node and use the deployer to push the app to all search head cluster members. Reference: [Install Splunk IT Service Intelligence on a search head cluster], [Install Splunk IT Service Intelligence on an indexer cluster]
What is the minimum number of entities a KPI must be split by in order to use Entity Cohesion anomaly detection?
For Entity Cohesion anomaly detection in Splunk IT Service Intelligence (ITSI), the minimum number of entities a KPI must be split by is 2. Entity Cohesion as a method of anomaly detection focuses on identifying anomalies based on the deviation of an entity's behavior in comparison to other entities within the same group or cohort. By requiring a minimum of only two entities, ITSI allows for the comparison of entities to detect significant deviations in one entity's performance or behavior, which could indicate potential issues. This method leverages the idea that entities performing similar functions or within the same service should exhibit similar patterns of behavior, and significant deviations could be indicative of anomalies. The low minimum requirement of two entities ensures that this powerful anomaly detection feature can be utilized even in smaller environments.
Fritz is looking at a Deep Dive with a lane showing the average percent of CPU usage across the four web servers in the web farm. Seeing a spike, he wants to add the graphs of each server on the swim lane, and selects the Lane Overlay Options to do so. No entity overlays are available for the KPI.
What is wrong with his KPI configuration?
In Splunk ITSI, swim lane overlays depend on a KPI being split by entity so that each entity's individual time series can be displayed separately in the Deep Dive view. When a KPI is aggregated without an entity split, it produces a single time series value at each timestamp representing the entire group (in this case, the average CPU across all web servers). Because that KPI does not contain per entity values, ITSI has nothing to overlay --- therefore no entity overlays appear in the Lane Overlay Options. This configuration mistake often happens when a KPI is defined to average values across sources without specifying an entity dimension on which to split results. Entity filtering is a separate feature that enables restricting which entities are considered in display or analytics and does not control availability of swim lane overlays; pseudo entities are artificial names that do not reflect actual system identities and are not relevant to this error; and having only three entities versus four would not prevent overlays from appearing if the KPI were correctly split by entity. The correct fix is to edit the KPI definition and configure it to split the metric results by the server entity field, such that each server has its own time series. This then enables Fritz to overlay the individual server CPU graphs on the swim lane as intended.
Which option best are the default ports that must be configured on Splunk to use ITSI?
C is the correct answer because ITSI uses the default ports of Splunk Enterprise for its communication and data collection. SplunkWeb uses port 8000, SplunkD uses port 8089, and HTTP Event Collector uses port 8088. These ports can be changed if needed, but they must match the configuration of Splunk Enterprise. Reference:Ports used by ITSI
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Karen Lee
13 days agoBrian Torres
4 days agoSteven Mitchell
11 days agoCordell
1 month agoRene
1 month agoLucina
2 months agoMichael
2 months agoRomana
2 months agoAnnmarie
2 months agoLezlie
3 months agoCarrol
3 months agoLennie
3 months agoHolley
3 months agoTuyet
4 months agoStefan
4 months agoDaren
4 months agoTeresita
4 months agoHuey
5 months agoAmie
5 months agoDerick
5 months agoDanilo
5 months agoCharlene
6 months agoJoanna
6 months agoRozella
6 months agoParis
6 months agoMarion
7 months agoFatima
7 months agoDona
7 months agoJosefa
7 months agoLai
8 months agoMalcolm
8 months agoJunita
8 months agoStanford
10 months agoRomana
11 months agoHoward
1 year agoLoreta
1 year agoDalene
1 year agoVeronika
1 year agoLemuel
1 year agoCrista
1 year agoRoxanne
1 year agoKing
1 year agoMoon
1 year agoLouis
2 years agoHorace
2 years agoJose
2 years agoDudley
2 years agoBong
2 years agoNicolette
2 years agoValda
2 years agoNorah
2 years agoMatthew
2 years agoKirk
2 years agoFlo
2 years agoSherell
2 years agoSena
2 years agoStephania
2 years agoLenna
2 years agoArlene
2 years agoMaricela
2 years agoYaeko
2 years agoLatrice
2 years ago