SPLK-3002 Sample Questions & Answers

For anomaly detection to be effective, especially with strong seasonal patterns, Splunk recommends a minimum of 30 days of historical data for training. This duration allows the machine learning algorithms to learn the daily and weekly patterns, establish a reliable baseline, and more accurately identify true anomalies rather than predictable peaks.

This is the most effective combination. A KPI lane is best for displaying the historical trend of the 'DB CPU Utilization %' KPI. A Metric lane is appropriate for charting the ad-hoc metric of 'Active DB Connections'. An Event lane is specifically designed to display raw log events, allowing the admin to see the actual error messages from the database server at specific points in time, correlating them with the KPI and metric trends.

This is the correct procedure for service-level access control in ITSI. Teams are the mechanism for assigning permissions to specific services. The correct workflow is: 1) Create a team (e.g., 'Banking Services Team'). 2) Assign the specific service (Online_Banking_Portal) to this team with 'read' permissions. 3) Assign the Splunk role (Banking_Ops) that contains the users to the newly created team. This ensures the users in that role only get the permissions defined for that team on that specific service.

The Service Health Score visualization is specifically designed for this purpose. It displays a service's health score as a colored shape (e.g., a hexagon or square), which is a common and effective way to represent overall status in a high-level monitoring view.

The Single Value visualization is excellent for NOC dashboards as it clearly displays the current health score or value of a critical KPI. Its color changes based on severity, providing an immediate visual cue of status (e.g., green, yellow, red).

Configuring the role column as an entity alias is the correct approach. The entity title (hostname) is the primary identifier. An alias provides an additional, searchable key-value pair associated with the entity. This allows KPI searches to be filtered or split by the alias role (e.g., role=webserver).

The primary purpose of service dependencies is to model the relationships between services so that the health status of a foundational (downstream) service can propagate to and impact the health of a service that relies on it (upstream). This enables more accurate root cause analysis and impact assessment.

In the KPI configuration, ITSI runs a base search first. The 'Search & Calculation' field expects only the statistical function to be applied to the results of the base search. Therefore, avg(response_time_ms) is the correct syntax. ITSI will automatically handle grouping the results over the 5-minute interval.

This is the correct approach. By setting the 'Robotics' service to inherit the health score of its most critical dependency, a critical status in 'Power Supply', 'Network Connectivity', or 'Control Software' will immediately cause the parent 'Robotics' service to also become critical. This accurately reflects the business impact where any single failure is catastrophic.

The data audit phase focuses on discovering and validating data sources to determine what can be monitored. Building the final, production-ready glass tables is a later step in the implementation process that occurs after services and KPIs have been designed and created. While the audit might inform the design of glass tables, building them is not a primary objective of the audit itself.

This statement is false. A base search is simply the initial SPL query that gathers the raw data for one or more KPIs. The statistical calculations (like stats avg(field)) are typically defined in the individual KPI's 'Search & Calculation' field, not in the base search itself. The base search can be a simple, non-transforming search.