Free SPLK-3002 sample questions

Correct answer: Time Policy

Time Policies are the correct feature for this scenario. They allow administrators to define different KPI threshold levels for specific time periods, such as business hours versus non-business hours. This directly addresses the need to have stricter thresholds during active trading and looser ones during off-hours to prevent false alarms.

Correct answer: A Notable Event Aggregation Policy

A Notable Event Aggregation Policy is designed specifically to solve this problem. It groups notable events into episodes based on defined criteria, such as time, CI/entity, or other fields. By creating a policy that groups events from the same service within a specific time window, the administrator can consolidate the multiple alerts into a single episode, reducing noise and simplifying investigation.

Correct answer: backup_itsi.py

The correct utility for backing up and restoring ITSI configurations is the `backup_itsi.py` script. This script is included with the ITSI installation and is specifically designed to export all ITSI-related KV Store collections and configuration files into a backup archive, which can later be used for restoration.

Correct answer: False

This statement is false. When a service is in maintenance mode, both its health score calculation is paused AND notable event generation for its KPIs is suppressed by default. This prevents false alarms and inaccurate health scores during planned maintenance periods.

Correct answers: Service Templates; Entity Filtering

Service Templates are ideal for this scenario. A single template can be created for the 'checkout-service' with all its associated KPIs. This template can then be used to create multiple service instances, ensuring that monitoring is consistent across all regions.

Entity Filtering is crucial for differentiating between the instances. The service template's KPIs can be configured to filter on an entity alias, such as 'region'. When creating services from the template, the administrator can specify 'us' or 'eu' for the region, automatically scoping the KPIs to the correct set of microservice entities.

Correct answer: 30 days

For anomaly detection to be effective, especially with strong seasonal patterns, Splunk recommends a minimum of 30 days of historical data for training. This duration allows the machine learning algorithms to learn the daily and weekly patterns, establish a reliable baseline, and more accurately identify true anomalies rather than predictable peaks.

Correct answer: A KPI lane for CPU, a Metric lane for Connections, and an Event lane for Logs

This is the most effective combination. A KPI lane is best for displaying the historical trend of the 'DB CPU Utilization %' KPI. A Metric lane is appropriate for charting the ad-hoc metric of 'Active DB Connections'. An Event lane is specifically designed to display raw log events, allowing the admin to see the actual error messages from the database server at specific points in time, correlating them with the KPI and metric trends.

Correct answer: Create a new team, assign the `Online_Banking_Portal` service to the team with read permissions, and then assign the `Banking_Ops` role to that team.

This is the correct procedure for service-level access control in ITSI. Teams are the mechanism for assigning permissions to specific services. The correct workflow is: 1) Create a team (e.g., 'Banking Services Team'). 2) Assign the specific service (`Online_Banking_Portal`) to this team with 'read' permissions. 3) Assign the Splunk role (`Banking_Ops`) that contains the users to the newly created team. This ensures the users in that role only get the permissions defined for that team on that specific service.

Correct answers: Single Value; Service Health Score

The Single Value visualization is excellent for NOC dashboards as it clearly displays the current health score or value of a critical KPI. Its color changes based on severity, providing an immediate visual cue of status (e.g., green, yellow, red).

The Service Health Score visualization is specifically designed for this purpose. It displays a service's health score as a colored shape (e.g., a hexagon or square), which is a common and effective way to represent overall status in a high-level monitoring view.

Correct answer: As an entity alias

Configuring the `role` column as an entity alias is the correct approach. The entity title (`hostname`) is the primary identifier. An alias provides an additional, searchable key-value pair associated with the entity. This allows KPI searches to be filtered or split by the alias `role` (e.g., `role=webserver`).