Splunk SPLK-3002 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-3002
- Exam Name: Splunk IT Service Intelligence Certified Admin Exam
- Certification Provider: Splunk
- Latest update: Oct 06,2026
Question #11
Which of the following is a characteristic of notable event groups?
- A . Notable event groups combine independent notable events.
- B . Notable event groups are created in the itsi_tracked_alerts index.
- C . Notable event groups allow users to adjust threshold settings.
- D . All of the above.
Correct Answer: A
A
Explanation:
In Splunk IT Service Intelligence (ITSI), notable event groups are used to logically group related notable events, which enhances the manageability and analysis of events:
A) Notable event groups combine independent notable events: This characteristic allows for the aggregation of related events into a single group, making it easier for users to manage and investigate related issues. By grouping events, users can focus on the broader context of an issue rather than getting lost in the details of individual events.
While notable event groups play a critical role in organizing and managing events in ITSI, they do not inherently allow users to adjust threshold settings, which is typically handled at the KPI or service level. Additionally, while notable event groups are utilized within the ITSI framework, the statement that they are created in the ‘itsi_tracked_alerts’ index might not fully capture the complexity of how event groups are managed and stored within the ITSI architecture.
A
Explanation:
In Splunk IT Service Intelligence (ITSI), notable event groups are used to logically group related notable events, which enhances the manageability and analysis of events:
A) Notable event groups combine independent notable events: This characteristic allows for the aggregation of related events into a single group, making it easier for users to manage and investigate related issues. By grouping events, users can focus on the broader context of an issue rather than getting lost in the details of individual events.
While notable event groups play a critical role in organizing and managing events in ITSI, they do not inherently allow users to adjust threshold settings, which is typically handled at the KPI or service level. Additionally, while notable event groups are utilized within the ITSI framework, the statement that they are created in the ‘itsi_tracked_alerts’ index might not fully capture the complexity of how event groups are managed and stored within the ITSI architecture.
Question #11
Which of the following is a characteristic of notable event groups?
- A . Notable event groups combine independent notable events.
- B . Notable event groups are created in the itsi_tracked_alerts index.
- C . Notable event groups allow users to adjust threshold settings.
- D . All of the above.
Correct Answer: A
A
Explanation:
In Splunk IT Service Intelligence (ITSI), notable event groups are used to logically group related notable events, which enhances the manageability and analysis of events:
A) Notable event groups combine independent notable events: This characteristic allows for the aggregation of related events into a single group, making it easier for users to manage and investigate related issues. By grouping events, users can focus on the broader context of an issue rather than getting lost in the details of individual events.
While notable event groups play a critical role in organizing and managing events in ITSI, they do not inherently allow users to adjust threshold settings, which is typically handled at the KPI or service level. Additionally, while notable event groups are utilized within the ITSI framework, the statement that they are created in the ‘itsi_tracked_alerts’ index might not fully capture the complexity of how event groups are managed and stored within the ITSI architecture.
A
Explanation:
In Splunk IT Service Intelligence (ITSI), notable event groups are used to logically group related notable events, which enhances the manageability and analysis of events:
A) Notable event groups combine independent notable events: This characteristic allows for the aggregation of related events into a single group, making it easier for users to manage and investigate related issues. By grouping events, users can focus on the broader context of an issue rather than getting lost in the details of individual events.
While notable event groups play a critical role in organizing and managing events in ITSI, they do not inherently allow users to adjust threshold settings, which is typically handled at the KPI or service level. Additionally, while notable event groups are utilized within the ITSI framework, the statement that they are created in the ‘itsi_tracked_alerts’ index might not fully capture the complexity of how event groups are managed and stored within the ITSI architecture.
Question #13
Which are true regarding ITSI glass tables? (Choose two)
- A . Glass tables are primarily used for data storage.
- B . Glass tables provide real-time visibility into operations.
- C . They can display data from multiple services.
- D . They require manual updates for real-time data.
Correct Answer: B, C
Question #14
When working with a notable event group in the Notable Events Review dashboard, which of the following can be set at the individual or group level?
- A . Service, status, owner.
- B . Severity, status, owner.
- C . Severity, comments, service.
- D . Severity, status, service.
Correct Answer: B
B
Explanation:
In the Notable Events Review dashboard within Splunk IT Service Intelligence (ITSI), when working with a notable event group, users can set or adjust certain attributes at the individual event level or at the group level.
These attributes include:
Severity: The importance or impact level of the notable event or group, which can be adjusted to reflect the current assessment of the situation.
Status: The current state of the notable event or group, such as "New," "In Progress," or "Resolved," indicating the progress in addressing the event or group.
Owner: The user or team responsible for managing and resolving the notable event or group.
These settings allow for effective management and tracking of notable events, ensuring that they are appropriately prioritized, acted upon, and resolved by the responsible parties.
B
Explanation:
In the Notable Events Review dashboard within Splunk IT Service Intelligence (ITSI), when working with a notable event group, users can set or adjust certain attributes at the individual event level or at the group level.
These attributes include:
Severity: The importance or impact level of the notable event or group, which can be adjusted to reflect the current assessment of the situation.
Status: The current state of the notable event or group, such as "New," "In Progress," or "Resolved," indicating the progress in addressing the event or group.
Owner: The user or team responsible for managing and resolving the notable event or group.
These settings allow for effective management and tracking of notable events, ensuring that they are appropriately prioritized, acted upon, and resolved by the responsible parties.
Question #15
Which is the least permissive role required to modify default deep dives?
- A . itoa_analyst
- B . admin
- C . power
- D . itoa_admin
Correct Answer: D
D
Explanation:
To modify default deep dives in Splunk IT Service Intelligence (ITSI), the least permissive role typically required is the itoa_admin role. This role is specifically designed within ITSI to provide administrative capabilities, including the ability to configure and customize various aspects of ITSI, such as services, KPIs, and deep dives. The itoa_admin role has the necessary permissions to edit and manage default deep dives, enabling users with this role to tailor the deep dives to meet specific operational requirements and preferences. Other roles like itoa_analyst, admin, or power might not have sufficient privileges to modify default deep dives, as these roles are generally more restricted in terms of their ability to make broad changes within ITSI.
D
Explanation:
To modify default deep dives in Splunk IT Service Intelligence (ITSI), the least permissive role typically required is the itoa_admin role. This role is specifically designed within ITSI to provide administrative capabilities, including the ability to configure and customize various aspects of ITSI, such as services, KPIs, and deep dives. The itoa_admin role has the necessary permissions to edit and manage default deep dives, enabling users with this role to tailor the deep dives to meet specific operational requirements and preferences. Other roles like itoa_analyst, admin, or power might not have sufficient privileges to modify default deep dives, as these roles are generally more restricted in terms of their ability to make broad changes within ITSI.
Question #16
Which index will contain useful error messages when troubleshooting ITSI issues?
- A . _introspection
- B . _internal
- C . itsi_summary
- D . itsi_notable_audit
Correct Answer: B
B
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/TroubleshootRE
The index that will contain useful error messages when troubleshooting ITSI issues is:
B) _internal. This is true because the _internal index contains logs and metrics generated by Splunk processes, such as splunkd and metrics.log. These logs can help you diagnose problems with your Splunk environment, including ITSI components and features.
The other indexes will not contain useful error messages because:
A) _introspection. This is not true because the _introspection index contains data about Splunk resource usage, such as CPU, memory, disk space, and so on. These data can help you monitor the performance and health of your Splunk environment, but not the error messages.
C) itsi_summary. This is not true because the itsi_summary index contains summarized data for your KPIs and services, such as health scores, severity levels, threshold values, and so on. These data can help you analyze the trends and anomalies of your IT services, but not the error messages.
D) itsi_notable_audit. This is not true because the itsi_notable_audit index contains audit data for your notable events and episodes, such as creation time, owner
B
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/TroubleshootRE
The index that will contain useful error messages when troubleshooting ITSI issues is:
B) _internal. This is true because the _internal index contains logs and metrics generated by Splunk processes, such as splunkd and metrics.log. These logs can help you diagnose problems with your Splunk environment, including ITSI components and features.
The other indexes will not contain useful error messages because:
A) _introspection. This is not true because the _introspection index contains data about Splunk resource usage, such as CPU, memory, disk space, and so on. These data can help you monitor the performance and health of your Splunk environment, but not the error messages.
C) itsi_summary. This is not true because the itsi_summary index contains summarized data for your KPIs and services, such as health scores, severity levels, threshold values, and so on. These data can help you analyze the trends and anomalies of your IT services, but not the error messages.
D) itsi_notable_audit. This is not true because the itsi_notable_audit index contains audit data for your notable events and episodes, such as creation time, owner
Question #17
Which of the following actions can be performed with a deep dive?
- A . Create a Multi-KPI alert from the deep dive’s current state to warn of similar situations in the future.
- B . Create a predictive analysis model from the deep dive to warn of future service degradation.
- C . Create an anomaly detection alert to show when the same pattern begins in the future.
- D . Create a custom service analyzer from selected deep dive lanes.
Correct Answer: A
A
Explanation:
Deep dives in Splunk IT Service Intelligence (ITSI) allow for an in-depth analysis of services and their KPIs over time, providing a detailed view of the operational health and performance trends. One of the powerful actions that can be performed with a deep dive is the creation of a Multi-KPI alert from the deep dive’s current state. This functionality enables users to define alerts based on the complex conditions observed during the deep dive analysis, allowing for the early detection of similar situations in the future. By configuring a Multi-KPI alert directly from a deep dive, ITSI users can leverage their insights and observations to proactively monitor for patterns or conditions that may indicate potential service degradation or failure, enhancing the overall responsiveness and effectiveness of the IT monitoring strategy.
A
Explanation:
Deep dives in Splunk IT Service Intelligence (ITSI) allow for an in-depth analysis of services and their KPIs over time, providing a detailed view of the operational health and performance trends. One of the powerful actions that can be performed with a deep dive is the creation of a Multi-KPI alert from the deep dive’s current state. This functionality enables users to define alerts based on the complex conditions observed during the deep dive analysis, allowing for the early detection of similar situations in the future. By configuring a Multi-KPI alert directly from a deep dive, ITSI users can leverage their insights and observations to proactively monitor for patterns or conditions that may indicate potential service degradation or failure, enhancing the overall responsiveness and effectiveness of the IT monitoring strategy.
Question #18
Which of the following describes a realistic troubleshooting workflow in ITSI?
- A . Correlation Search C> Deep Dive C> Notable Event
- B . Service Analyzer C> Notable Event Review C> Deep Dive
- C . Service Analyzer C> Aggregation Policy C> Deep Dive
- D . Correlation search C> KPI C> Aggregation Policy
Correct Answer: B
B
Explanation:
A realistic troubleshooting workflow in ITSI is:
B) Service Analyzer C> Notable Event Review C> Deep Dive
This workflow involves using the Service Analyzer dashboard to monitor the health and performance of your services and KPIs, using the Notable Event Review dashboard to investigate and manage the notable events generated by ITSI, and using the Deep Dive dashboard to analyze the historical trends and anomalies of your KPIs and metrics.
The other workflows are not realistic because they involve components that are not part of the troubleshooting process, such as correlation search, aggregation policy, and KPI. These components are used to create and configure the alerts and episodes that ITSI generates, not to investigate and resolve them.
Reference: [Service Analyzer dashboard in ITSI], Overview of Episode Review in ITSI, [Overview of deep dives in ITSI]
B
Explanation:
A realistic troubleshooting workflow in ITSI is:
B) Service Analyzer C> Notable Event Review C> Deep Dive
This workflow involves using the Service Analyzer dashboard to monitor the health and performance of your services and KPIs, using the Notable Event Review dashboard to investigate and manage the notable events generated by ITSI, and using the Deep Dive dashboard to analyze the historical trends and anomalies of your KPIs and metrics.
The other workflows are not realistic because they involve components that are not part of the troubleshooting process, such as correlation search, aggregation policy, and KPI. These components are used to create and configure the alerts and episodes that ITSI generates, not to investigate and resolve them.
Reference: [Service Analyzer dashboard in ITSI], Overview of Episode Review in ITSI, [Overview of deep dives in ITSI]
Question #19
Which index is used to store KPI values?
- A . itsi_summary_metrics
- B . itsi_metrics
- C . itsi_service_health
- D . itsi_summary
Correct Answer: A
A
Explanation:
The IT Service Intelligence (ITSI) metrics summary index, itsi_summary_metrics, is a metrics-based summary index that stores KPI data.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/MetricsIndexRef
A is the correct answer because the itsi_summary_metrics index is used to store KPI values in ITSI. This index improves the performance of the searches dispatched by ITSI, particularly for very large environments. Every KPI is summarized in both the itsi_summary events index and the itsi_summary_metrics metrics index.
Reference: Overview of ITSI indexes
A
Explanation:
The IT Service Intelligence (ITSI) metrics summary index, itsi_summary_metrics, is a metrics-based summary index that stores KPI data.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/MetricsIndexRef
A is the correct answer because the itsi_summary_metrics index is used to store KPI values in ITSI. This index improves the performance of the searches dispatched by ITSI, particularly for very large environments. Every KPI is summarized in both the itsi_summary events index and the itsi_summary_metrics metrics index.
Reference: Overview of ITSI indexes
Question #20
What is the default storage mechanism for KPI thresholds in ITSI?
- A . KV Store
- B . Lookup tables
- C . Indexed storage
- D . Configuration files
Correct Answer: A