Splunk IT Service Intelligence Certified Admin (SPLK-3002) practice questions

Exam overview SPLK-3002

Domain coverage 16 domains

• Introducing ITSI (5%)
• Glass Tables (5%)
• Managing Notable Events (10%)
• Investigating Issues with Deep Dives (10%)
• Installing and Configuring ITSI (10%)
• Designing Services (5%)
• Data Audit and Base Searches (5%)
• Implementing Services (5%)
• Thresholds and Time Policies (5%)
• Entities and Modules (5%)
• Templates and Dependencies (5%)
• Anomaly Detection (5%)
• Correlation & Multi-KPI Searches (5%)
• Aggregation Policies (5%)
• Access Control (5%)
• Troubleshooting ITSI (10%)

Sample questions 9 of 88 shown

1. Q1 Introducing ITSI (5%)

   What is the primary function of Splunk IT Service Intelligence (ITSI)?

   1. To provide real-time visibility into the health of IT and business services using machine learning
   2. To perform security event correlation
   3. To manage network configurations
   4. To replace the Splunk search head

   Splunk IT Service Intelligence (ITSI) is an AIOps solution that provides real-time visibility into the health and performance of critical IT and business services. It uses machine learning for anomaly detection, predictive analytics, and service-level monitoring to help IT operations teams identify and resolve issues faster.
2. Q2 Introducing ITSI (5%)

   What is a key benefit of using Splunk ITSI for IT operations?

   1. Reducing alert noise through service-based correlation and aggregation
   2. Replacing all existing monitoring tools
   3. Eliminating the need for Splunk administrators
   4. Automatically fixing all infrastructure issues

   One of the primary benefits of ITSI is reducing alert noise by correlating and aggregating alerts into service-based notable events. ITSI groups related alerts by service, uses anomaly detection to identify true issues, and provides a single pane of glass for IT operations teams to focus on critical service health.
3. Q3 Introducing ITSI (5%)

   Which component of the ITSI architecture provides the user interface for service health monitoring?

   1. ITSI module
   2. ITSI app on the Splunk search head
   3. ITSI indexer cluster
   4. ITSI forwarder

   ITSI runs as an application on the Splunk search head. The ITSI app provides the user interface, including Glass Tables, Episode Review (notable events), deep dives, and service analyzers. It extends the Splunk platform with AIOps-specific capabilities.
4. Q4 Introducing ITSI (5%)

   What types of users typically benefit most from Splunk ITSI?

   1. IT operations teams and service owners
   2. Only security analysts
   3. Only application developers
   4. Only network engineers

   ITSI is designed primarily for IT operations (ITOps) teams and service owners who need to monitor the health and performance of IT services. It provides service-level dashboards, anomaly detection, and event correlation to help operations teams maintain service availability and performance.
5. Q5 Glass Tables (5%)

   What is a Glass Table in Splunk ITSI?

   1. A customizable real-time visualization dashboard for displaying service health KPIs
   2. A physical glass monitor for SOC displays
   3. A type of search head hardware
   4. A configuration file for ITSI settings

   A Glass Table in ITSI is a highly customizable, real-time visualization dashboard designed for displaying service health, KPIs, and key metrics. It can include tiles showing service health scores, KPI values, and other visualizations, and is commonly used for NOC (Network Operations Center) wall displays.
6. Q6 Glass Tables (5%)

   A KPI tile on a Glass Table can be configured to drill down to which of the following?

   1. Another Glass Table
   2. A Splunk dashboard
   3. A custom deep dive
   4. Any of the above

   KPI tiles on Glass Tables support drill-down actions that can navigate to multiple target types: another Glass Table (for more detailed service views), a standard Splunk dashboard (for broader analytics), or a custom deep dive (for in-depth KPI investigation). This provides flexible navigation for operators.
7. Q7 Glass Tables (5%)

   An administrator needs to design a Glass Table for NOC display. Which types of tiles can be added?

   1. KPI tiles, service health tiles, and custom visualization tiles
   2. Only KPI tiles
   3. Only service health tiles
   4. Only text tiles

   Glass Tables support multiple tile types including KPI tiles (showing specific KPI values), service health tiles (showing overall service health scores), and custom visualization tiles (based on Splunk searches or ITSI data). This flexibility allows administrators to create comprehensive NOC displays.
8. Q8 Glass Tables (5%)

   How can a Glass Table be shared with different ITSI users?

   1. By setting appropriate permissions through the ITSI access control settings
   2. By copying the Glass Table XML to each user's system
   3. By emailing the Glass Table URL to users
   4. By exporting and importing the Glass Table

   Glass Tables can be shared through ITSI's access control settings, where administrators set permissions for viewing and editing. This ensures that only users with the appropriate role (itoa_admin, itoa_team_admin, or itoa_analyst) can access specific Glass Tables based on their assigned services and teams.
9. Q9 Managing Notable Events (10%)

   Which of the following describes a notable event group in ITSI?

   1. A notable event group logically combines individual notable events for easier management
   2. A notable event group is created in the itsi_tracked_alerts index
   3. A notable event group allows users to adjust threshold settings
   4. All of the above

   A notable event group in ITSI logically combines individual notable events that are related, making them easier to manage and investigate. Groups aggregate related alerts so operators can address the root cause rather than individual symptoms. Groups are created through aggregation policies.

Answer all 88 questions with instant feedback →

Reader reviews 159 ratings

• I have tried many Splunk practice tests and this SPLK-3002 bank is by far the most accurate and well-organized.

  ★★★★★★ Kevin N.

• I bought the SPLK-3002 question bank a week before my exam and passed with 90%+. The questions are that good.

  ★★★★★ Maria V.

• Three of my coworkers used this for SPLK-3002 and all passed. Figured I’d give it a shot — worked like a charm.

  ★★★★★★ Derek S.

• Comparing this with other Splunk practice tests, this one feels the most like the real SPLK-3002 exam.

  ★★★★★★ Mia R.

• Detailed, organized, and accurate. Exactly what you want in SPLK-3002 prep material. The explanations deserve special mention.

  ★★★★★★ Gabriel L.

• The SPLK-3002 bank has a good mix of easy, medium, and hard questions. Kept me engaged and prevented me from getting complacent.

  ★★★★★★ Skylar M.

Frequently asked questions

More Splunk exams