Splunk SPLK-3002 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-3002
- Exam Name: Splunk IT Service Intelligence Certified Admin Exam
- Certification Provider: Splunk
- Latest update: Oct 06,2026
Question #1
Which deep dive swim lane type does not require writing SPL?
- A . Event lane.
- B . Automatic lane.
- C . Metric lane.
- D . KPI lane.
Correct Answer: D
D
Explanation:
A KPI lane is a type of deep dive swim lane that does not require writing SPL. You can simply select a service and a KPI from a drop-down list and ITSI will automatically populate the lane with the corresponding data. You can also adjust the threshold settings and time range for the KPI lane.
Reference: [KPI Lanes]
D
Explanation:
A KPI lane is a type of deep dive swim lane that does not require writing SPL. You can simply select a service and a KPI from a drop-down list and ITSI will automatically populate the lane with the corresponding data. You can also adjust the threshold settings and time range for the KPI lane.
Reference: [KPI Lanes]
Question #2
Which of the following is a good use case for a Multi-KPI alert?
- A . Alerting when the values of two or more KPIs go into maintenance mode.
- B . Alerting when the trend of two or more KPIs indicates service failure is imminent.
- C . Alerting when two or more KPIs are deviating from their typical pattern.
- D . Alerting when comparing the values of two or more KPIs indicates an unusual condition is occurring.
Correct Answer: D
D
Explanation:
A Multi-KPI alert in Splunk IT Service Intelligence (ITSI) is designed to trigger based on the conditions of multiple Key Performance Indicators (KPIs). This type of alert is particularly useful when a single KPI’s state is not sufficient to indicate an issue, but the correlation between multiple KPIs can provide a clearer picture of an emerging problem. The best use case for a Multi-KPI alert is therefore when comparing the values of two or more KPIs indicates an unusual condition is occurring. This allows for more nuanced and context-rich alerting mechanisms that can identify complex issues not detectable by monitoring individual KPIs. This approach is beneficial in complex environments where the interplay between different performance metrics needs to be considered to accurately detect and diagnose issues.
D
Explanation:
A Multi-KPI alert in Splunk IT Service Intelligence (ITSI) is designed to trigger based on the conditions of multiple Key Performance Indicators (KPIs). This type of alert is particularly useful when a single KPI’s state is not sufficient to indicate an issue, but the correlation between multiple KPIs can provide a clearer picture of an emerging problem. The best use case for a Multi-KPI alert is therefore when comparing the values of two or more KPIs indicates an unusual condition is occurring. This allows for more nuanced and context-rich alerting mechanisms that can identify complex issues not detectable by monitoring individual KPIs. This approach is beneficial in complex environments where the interplay between different performance metrics needs to be considered to accurately detect and diagnose issues.
Question #3
Which of the following describes default deep dives?
- A . Are manually generated and can be accessed via the Service Analyzer.
- B . Include all KPIs of all services.
- C . Are auto-generated and can be accessed via the Service Analyzer.
- D . Include health scores of all services.
Correct Answer: C
C
Explanation:
In Splunk IT Service Intelligence (ITSI), default deep dives are auto-generated and can be accessed via the Service Analyzer. Deep dives are an essential feature of ITSI that provide an in-depth, granular view into the health and performance of services and their associated KPIs. These default deep dives are automatically created for each service, allowing users to quickly drill down into the detailed operational metrics and performance data of their services. By accessing these deep dives through the Service Analyzer, ITSI users can efficiently investigate issues, understand service dependencies, and make informed decisions to maintain optimal service health. The auto-generated nature of these default deep dives simplifies the monitoring and analysis process, providing immediate insights into service performance without the need for manual setup or configuration.
C
Explanation:
In Splunk IT Service Intelligence (ITSI), default deep dives are auto-generated and can be accessed via the Service Analyzer. Deep dives are an essential feature of ITSI that provide an in-depth, granular view into the health and performance of services and their associated KPIs. These default deep dives are automatically created for each service, allowing users to quickly drill down into the detailed operational metrics and performance data of their services. By accessing these deep dives through the Service Analyzer, ITSI users can efficiently investigate issues, understand service dependencies, and make informed decisions to maintain optimal service health. The auto-generated nature of these default deep dives simplifies the monitoring and analysis process, providing immediate insights into service performance without the need for manual setup or configuration.
Question #4
Which of the following describes a way to delete multiple duplicate entities in ITSI?
- A . Via c CSV upload.
- B . Via the entity lister page.
- C . Via a search using the | deleteentity command.
- D . All of the above.
Correct Answer: D
D
Explanation:
D is the correct answer because ITSI provides multiple ways to delete multiple duplicate entities. You can use a CSV upload to overwrite existing entities with new or updated information, or delete them by setting the action field to delete. You can also use the entity lister page to select multiple entities and delete them in bulk. Alternatively, you can use a search command called | deleteentity to delete entities that match certain criteria.
Reference: Create and update entities using a CSV file in ITSI, Delete entities in bulk in ITSI, Delete entities using the | deleteentity command in ITSI
D
Explanation:
D is the correct answer because ITSI provides multiple ways to delete multiple duplicate entities. You can use a CSV upload to overwrite existing entities with new or updated information, or delete them by setting the action field to delete. You can also use the entity lister page to select multiple entities and delete them in bulk. Alternatively, you can use a search command called | deleteentity to delete entities that match certain criteria.
Reference: Create and update entities using a CSV file in ITSI, Delete entities in bulk in ITSI, Delete entities using the | deleteentity command in ITSI
Question #5
When must a service define entity rules?
- A . If the intention is for the KPIs in the service to filter to only entities assigned to the service.
- B . To enable entity cohesion anomaly detection.
- C . If some or all of the KPIs in the service will be split by entity.
- D . If the intention is for the KPIs in the service to have different aggregate vs. entity KPI values.
Correct Answer: A
A
Explanation:
Provide a value to filter the service to a specific set of entities. These entity rule values are meant to be custom for each service.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/EntityRules
A is the correct answer because a service must define entity rules if the intention is for the KPIs in the service to filter to only entities assigned to the service. Entity rules are filters that match entities to services based on entity aliases or entity metadata. If you enable the Filter to Entities in Service option for a KPI, you need to define entity rules for the service to ensure that the KPI search results only include the relevant entities for the service. Otherwise, the KPI search results might include
entities that are not part of the service or exclude entities that are part of the service.
Reference: [Define entities for a service in ITSI], [Configure KPI settings in ITSI]
A
Explanation:
Provide a value to filter the service to a specific set of entities. These entity rule values are meant to be custom for each service.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/EntityRules
A is the correct answer because a service must define entity rules if the intention is for the KPIs in the service to filter to only entities assigned to the service. Entity rules are filters that match entities to services based on entity aliases or entity metadata. If you enable the Filter to Entities in Service option for a KPI, you need to define entity rules for the service to ensure that the KPI search results only include the relevant entities for the service. Otherwise, the KPI search results might include
entities that are not part of the service or exclude entities that are part of the service.
Reference: [Define entities for a service in ITSI], [Configure KPI settings in ITSI]
Question #6
What is the primary purpose of correlation searches in ITSI?
- A . To optimize search speeds
- B . To detect patterns across data sources
- C . To backup data regularly
- D . To reduce license usage
Correct Answer: B
Question #7
Which of the following items describe ITSI teams? (select all that apply)
- A . Teams should have itoa admin roles added with read-only permissions for services and entities.
- B . Services should be assigned to the ‘global’ team if all users need access to it.
- C . By default, all services are owned by the built-in ‘global’ team and administered by the ‘itoa_admin’ role.
- D . A new team admin role should be created for each team. The new role should inherit the ‘itoa_team_admin’ role.
Correct Answer: BCD
BCD
Explanation:
In Splunk IT Service Intelligence (ITSI), teams are used to organize services, KPIs, and other objects within ITSI to facilitate access control and management:
B) Services should be assigned to the ‘global’ team if all users need access to it: The ‘global’ team in ITSI is a built-in concept that denotes universal accessibility. Assigning services to the ‘global’ team makes them accessible to all ITSI users, irrespective of their specific team memberships. This is useful for services that are relevant across the entire organization.
C) By default, all services are owned by the built-in ‘global’ team and administered by the ‘itoa_admin’ role: This default setting ensures that upon creation, services are accessible to administrators and can be further re-assigned or refined for access by specific teams as needed.
D) A new team admin role should be created for each team. The new role should inherit the ‘itoa_team_admin’ role: This best practice allows for granular access control and management within teams. Each team can have its own administrators with the appropriate level of access and permissions tailored to the needs of that team, derived from the capabilities of the ‘itoa_team_admin’ role.
The concept of adding ‘itoa admin roles’ with read-only permissions contradicts the typical use case for administrative roles, which usually require more than read-only access to manage services and entities effectively.
BCD
Explanation:
In Splunk IT Service Intelligence (ITSI), teams are used to organize services, KPIs, and other objects within ITSI to facilitate access control and management:
B) Services should be assigned to the ‘global’ team if all users need access to it: The ‘global’ team in ITSI is a built-in concept that denotes universal accessibility. Assigning services to the ‘global’ team makes them accessible to all ITSI users, irrespective of their specific team memberships. This is useful for services that are relevant across the entire organization.
C) By default, all services are owned by the built-in ‘global’ team and administered by the ‘itoa_admin’ role: This default setting ensures that upon creation, services are accessible to administrators and can be further re-assigned or refined for access by specific teams as needed.
D) A new team admin role should be created for each team. The new role should inherit the ‘itoa_team_admin’ role: This best practice allows for granular access control and management within teams. Each team can have its own administrators with the appropriate level of access and permissions tailored to the needs of that team, derived from the capabilities of the ‘itoa_team_admin’ role.
The concept of adding ‘itoa admin roles’ with read-only permissions contradicts the typical use case for administrative roles, which usually require more than read-only access to manage services and entities effectively.
Question #8
Which of the following is a characteristic of custom deep dives?
- A . Allows itoa_analyst roles to add comments.
- B . Requires at least 7 days’ data to show anomalies.
- C . Combines metric, event, KPI, and service health score lanes.
- D . Uses drilldown to generate notable events via anomaly detection.
Correct Answer: C
C
Explanation:
Custom deep dives in Splunk IT Service Intelligence (ITSI) are versatile and highly customizable dashboards that allow users to analyze various types of data in a unified view. One of the key characteristics of custom deep dives is their ability to combine lanes of different data types, such as metrics, events, Key Performance Indicators (KPIs), and service health scores. This multifaceted approach provides a comprehensive and layered view of the IT environment, enabling analysts and operators to correlate different data types and gain deeper insights into the health and performance of services. By incorporating these diverse data lanes, custom deep dives facilitate a more holistic understanding of the operational landscape, aiding in more effective troubleshooting and decision-making.
C
Explanation:
Custom deep dives in Splunk IT Service Intelligence (ITSI) are versatile and highly customizable dashboards that allow users to analyze various types of data in a unified view. One of the key characteristics of custom deep dives is their ability to combine lanes of different data types, such as metrics, events, Key Performance Indicators (KPIs), and service health scores. This multifaceted approach provides a comprehensive and layered view of the IT environment, enabling analysts and operators to correlate different data types and gain deeper insights into the health and performance of services. By incorporating these diverse data lanes, custom deep dives facilitate a more holistic understanding of the operational landscape, aiding in more effective troubleshooting and decision-making.
Question #9
Which ITSI functions generate notable events? (Choose all that apply.)
- A . KPI threshold breaches.
- B . KPI anomaly detection.
- C . Multi-KPI alert.
- D . Correlation search.
Correct Answer: A, B, D
A, B, D
Explanation:
After you configure KPI thresholds, you can set up alerts to notify you when aggregate KPI severities change. ITSI generates notable events in Episode Review based on the alerting rules you configure. Anomaly detection generates notable events when a KPI IT Service Intelligence (ITSI) deviates from an expected pattern.
Notable events are typically generated by a correlation search.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/KPIthresholds https://docs.splunk.com/Documentation/ITSI/4.10.1/SI/AboutSI
A, B, and D are correct answers because ITSI can generate notable events when a KPI breaches a threshold, when a KPI detects an anomaly, or when a correlation search matches a defined pattern. These are the main ways that ITSI can alert you to potential issues or incidents in your IT environment.
Reference: Configure KPI thresholds in ITSI, Apply anomaly detection to a KPI in ITSI, Generate events with correlation searches in ITSI
A, B, D
Explanation:
After you configure KPI thresholds, you can set up alerts to notify you when aggregate KPI severities change. ITSI generates notable events in Episode Review based on the alerting rules you configure. Anomaly detection generates notable events when a KPI IT Service Intelligence (ITSI) deviates from an expected pattern.
Notable events are typically generated by a correlation search.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/KPIthresholds https://docs.splunk.com/Documentation/ITSI/4.10.1/SI/AboutSI
A, B, and D are correct answers because ITSI can generate notable events when a KPI breaches a threshold, when a KPI detects an anomaly, or when a correlation search matches a defined pattern. These are the main ways that ITSI can alert you to potential issues or incidents in your IT environment.
Reference: Configure KPI thresholds in ITSI, Apply anomaly detection to a KPI in ITSI, Generate events with correlation searches in ITSI
Question #10
Which of the following items describe ITSI Deep Dive capabilities? (Choose all that apply.)
- A . Comparing a service’s notable events over a time period.
- B . Visualizing one or more Service KPIs values by time.
- C . Examining and comparing alert levels for KPIs in a service over time.
- D . Comparing swim lane values for a slice of time.
Correct Answer: B, C, D
B, C, D
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/DeepDives
A deep dive is a dashboard that allows you to analyze the historical trends and anomalies of your KPIs and metrics in ITSI. A deep dive displays a timeline of events and swim lanes of data that you can customize and filter to investigate issues and perform root cause analysis. Some of the capabilities of deep dives are:
B) Visualizing one or more service KPIs values by time. This is true because you can add KPI swim lanes to a deep dive to show the values and severity levels of one or more KPIs over time. You can also compare KPIs from different services or entities using service swapping or entity splitting.
C) Examining and comparing alert levels for KPIs in a service over time. This is true because you can add alert swim lanes to a deep dive to show the alert levels and counts for one or more KPIs over time. You can also drill down into the alert details and view the notable events associated with each alert.
D) Comparing swim lane values for a slice of time. This is true because you can use the time range selector to zoom in or out of a specific time range in a deep dive. You can also use the time brush to select a slice of time and compare the swim lane values for that time period.
The other option is not a capability of deep dives because:
A) Comparing a service’s notable events over a time period. This is not true because deep dives do not display notable events, which are alerts generated by ITSI based on certain conditions or correlations. Notable events are displayed in other dashboards, such as episode review or glass tables.
Reference: [Overview of deep dives in ITSI], [Add swim lanes to a deep dive in ITSI]
B, C, D
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/DeepDives
A deep dive is a dashboard that allows you to analyze the historical trends and anomalies of your KPIs and metrics in ITSI. A deep dive displays a timeline of events and swim lanes of data that you can customize and filter to investigate issues and perform root cause analysis. Some of the capabilities of deep dives are:
B) Visualizing one or more service KPIs values by time. This is true because you can add KPI swim lanes to a deep dive to show the values and severity levels of one or more KPIs over time. You can also compare KPIs from different services or entities using service swapping or entity splitting.
C) Examining and comparing alert levels for KPIs in a service over time. This is true because you can add alert swim lanes to a deep dive to show the alert levels and counts for one or more KPIs over time. You can also drill down into the alert details and view the notable events associated with each alert.
D) Comparing swim lane values for a slice of time. This is true because you can use the time range selector to zoom in or out of a specific time range in a deep dive. You can also use the time brush to select a slice of time and compare the swim lane values for that time period.
The other option is not a capability of deep dives because:
A) Comparing a service’s notable events over a time period. This is not true because deep dives do not display notable events, which are alerts generated by ITSI based on certain conditions or correlations. Notable events are displayed in other dashboards, such as episode review or glass tables.
Reference: [Overview of deep dives in ITSI], [Add swim lanes to a deep dive in ITSI]