Splunk SPLK-3002 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-3002
- Exam Name: Splunk IT Service Intelligence Certified Admin Exam
- Certification Provider: Splunk
- Latest update: Oct 06,2026
Question #40
Which of the following is part of setting up a new aggregation policy?
- A . Filtering criteria
- B . Policy version
- C . Review order
- D . Module rules
Correct Answer: A
A
Explanation:
When setting up a new aggregation policy in Splunk IT Service Intelligence (ITSI), one of the crucial components is defining the filtering criteria. This aspect of the aggregation policy determines which events should be included in the aggregation based on specific conditions or attributes. The filtering criteria can be based on various event fields such as severity, source, event type, and other custom fields relevant to the organization’s monitoring strategy. By specifying the filtering criteria, ITSI administrators can ensure that the aggregation policy is applied only to the pertinent events, thus facilitating more targeted and effective event management and reducing noise in the operational environment. This helps in organizing and prioritizing events more efficiently, enhancing the overall incident management process within ITSI.
A
Explanation:
When setting up a new aggregation policy in Splunk IT Service Intelligence (ITSI), one of the crucial components is defining the filtering criteria. This aspect of the aggregation policy determines which events should be included in the aggregation based on specific conditions or attributes. The filtering criteria can be based on various event fields such as severity, source, event type, and other custom fields relevant to the organization’s monitoring strategy. By specifying the filtering criteria, ITSI administrators can ensure that the aggregation policy is applied only to the pertinent events, thus facilitating more targeted and effective event management and reducing noise in the operational environment. This helps in organizing and prioritizing events more efficiently, enhancing the overall incident management process within ITSI.
Question #42
In ITSI, what is the result of enabling anomaly detection on a KPI?
- A . Increased data storage use
- B . Automatic baseline creation
- C . Reduced alert sensitivity
- D . Manual threshold adjustment
Correct Answer: B
Question #43
What is the range for a normal Service Health score category?
- A . 20-40
- B . 40-60
- C . 60-80
- D . 80-100
Correct Answer: D
D
Explanation:
In Splunk IT Service Intelligence (ITSI), the Service Health Score is a metric that provides a quantifiable measure of the overall health and performance of a service. The score ranges from 0 to 100, with higher scores indicating better health. The range for a normal Service Health score category is typically from 80 to 100. Scores within this range suggest that the service is performing well, with no significant issues affecting its health. This categorization helps IT and business stakeholders quickly assess the operational status of their services, enabling them to focus on services that may require attention or intervention due to lower health scores.
D
Explanation:
In Splunk IT Service Intelligence (ITSI), the Service Health Score is a metric that provides a quantifiable measure of the overall health and performance of a service. The score ranges from 0 to 100, with higher scores indicating better health. The range for a normal Service Health score category is typically from 80 to 100. Scores within this range suggest that the service is performing well, with no significant issues affecting its health. This categorization helps IT and business stakeholders quickly assess the operational status of their services, enabling them to focus on services that may require attention or intervention due to lower health scores.
Question #44
Which of the following best describes a default deep dive?
- A . It initially shows the health scores for all services.
- B . It initially shows the highest importance KPIs.
- C . It initially shows all of the KPIs for a selected service.
- D . It initially shows all the entity swim lanes.
Correct Answer: C
C
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/DeepDives
C is the correct answer because a default deep dive initially shows all of the KPIs for a selected service. You can create a default deep dive by drilling down from another dashboard or by selecting a service from the deep dive lister page. A default deep dive does not show health scores, importance scores, or entity swim lanes by default.
Reference: [Create default deep dives for services in ITSI]
C
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/DeepDives
C is the correct answer because a default deep dive initially shows all of the KPIs for a selected service. You can create a default deep dive by drilling down from another dashboard or by selecting a service from the deep dive lister page. A default deep dive does not show health scores, importance scores, or entity swim lanes by default.
Reference: [Create default deep dives for services in ITSI]
Question #45
How are entities typically defined in ITSI?
- A . By their data types
- B . By their KPI values
- C . By their alias values
- D . By their storage capacity
Correct Answer: C
Question #46
When changing a service template, which of the following will be added to linked services by default?
- A . Thresholds.
- B . Entity Rules.
- C . New KPIs.
- D . Health score.
Correct Answer: C
C
Explanation:
C) New KPIs. This is true because when you add new KPIs to a service template, they will be automatically added to all the services that are linked to that template. This helps you keep your services consistent and up-to-date with the latest KPI definitions.
The other options will not be added to linked services by default because:
A) Thresholds. This is not true because when you change thresholds in a service template, they will not affect the existing thresholds in the linked services. You need to manually apply the threshold changes to each linked service if you want them to inherit the new thresholds from the template.
B) Entity rules. This is not true because when you change entity rules in a service template, they will not affect the existing entity rules in the linked services. You need to manually apply the entity rule changes to each linked service if you want them to inherit the new entity rules from the template.
D) Health score. This is not true because when you change health score settings in a service template, they will not affect the existing health score settings in the linked services. You need to manually apply the health score changes to each linked service if you want them to inherit the new health score settings from the template.
Reference: Create and manage service templates in ITSI, [Apply service template changes to linked services in ITSI]
C
Explanation:
C) New KPIs. This is true because when you add new KPIs to a service template, they will be automatically added to all the services that are linked to that template. This helps you keep your services consistent and up-to-date with the latest KPI definitions.
The other options will not be added to linked services by default because:
A) Thresholds. This is not true because when you change thresholds in a service template, they will not affect the existing thresholds in the linked services. You need to manually apply the threshold changes to each linked service if you want them to inherit the new thresholds from the template.
B) Entity rules. This is not true because when you change entity rules in a service template, they will not affect the existing entity rules in the linked services. You need to manually apply the entity rule changes to each linked service if you want them to inherit the new entity rules from the template.
D) Health score. This is not true because when you change health score settings in a service template, they will not affect the existing health score settings in the linked services. You need to manually apply the health score changes to each linked service if you want them to inherit the new health score settings from the template.
Reference: Create and manage service templates in ITSI, [Apply service template changes to linked services in ITSI]
Question #47
Which of the following is a valid type of Multi-KPI Alert?
- A . Score over composite.
- B . Value over time.
- C . Status over time.
- D . Rise over run.
Correct Answer: B
B
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/MKA
B is the correct answer because value over time is a valid type of Multi-KPI Alert in ITSI. A Multi-KPI Alert is a type of alert that triggers when multiple KPIs from one or more services meet certain conditions within a specified time range. Value over time is a condition that compares the current value of a KPI to its previous values over a specified time range .
For example, you can create a Multi-KPI Alert that triggers when the CPU usage and memory usage of a service are both higher than their average values in the last 24 hours.
Reference: [Create Multi-KPI alerts in ITSI], [Multi-KPI alert conditions in ITSI]
B
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/MKA
B is the correct answer because value over time is a valid type of Multi-KPI Alert in ITSI. A Multi-KPI Alert is a type of alert that triggers when multiple KPIs from one or more services meet certain conditions within a specified time range. Value over time is a condition that compares the current value of a KPI to its previous values over a specified time range .
For example, you can create a Multi-KPI Alert that triggers when the CPU usage and memory usage of a service are both higher than their average values in the last 24 hours.
Reference: [Create Multi-KPI alerts in ITSI], [Multi-KPI alert conditions in ITSI]
Question #48
Which of the following is a best practice for identifying the most effective services with which to start an iterative ITSI deployment?
- A . Only include KPIs if they will be used in multiple services.
- B . Analyze the business to determine the most critical services.
- C . Focus on low-level services.
- D . Define a large number of key services early.
Correct Answer: B
B
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/MKA
A best practice for identifying the most effective services with which to start an iterative ITSI deployment is to analyze the business to determine the most critical services that have the most impact on revenue, customer satisfaction, or other key performance indicators. You can use the Service Analyzer to prioritize and monitor these services.
Reference: Service Analyzer
B
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/MKA
A best practice for identifying the most effective services with which to start an iterative ITSI deployment is to analyze the business to determine the most critical services that have the most impact on revenue, customer satisfaction, or other key performance indicators. You can use the Service Analyzer to prioritize and monitor these services.
Reference: Service Analyzer
Question #49
Which capabilities are enabled through “teams”?
- A . Teams allow searches against the itsi_summary index.
- B . Teams restrict notable event alert actions.
- C . Teams restrict searches against the itsi_notable_audit index.
- D . Teams allow restrictions to service content in UI views.
Correct Answer: D
D
Explanation:
D is the correct answer because teams allow you to restrict access to service content in UI views such as service analyzers, glass tables, deep dives, and episode review. Teams also control access to services and KPIs for editing and viewing purposes. Teams do not affect the ability to search against the itsi_summary index, restrict notable event alert actions, or restrict searches against the itsi_notable_audit index.
Reference: Overview of teams in ITSI
D
Explanation:
D is the correct answer because teams allow you to restrict access to service content in UI views such as service analyzers, glass tables, deep dives, and episode review. Teams also control access to services and KPIs for editing and viewing purposes. Teams do not affect the ability to search against the itsi_summary index, restrict notable event alert actions, or restrict searches against the itsi_notable_audit index.
Reference: Overview of teams in ITSI
Question #50
Which of the following statements describe default glass tables in ITSI?
- A . The Service Health Score default glass table.
- B . There is one default glass table per service.
- C . There is one service template default glass table.
- D . There are no default glass tables.
Correct Answer: D
D
Explanation:
In Splunk IT Service Intelligence (ITSI), glass tables are fully customizable dashboards that provide a visual representation of an organization’s IT environment, along with the health and status of services and KPIs. Unlike some pre-configured views or dashboards that might come with default setups in various platforms, ITSI does not provide default glass tables out of the box. Instead, users are encouraged to create their own glass tables tailored to their specific monitoring needs and operational views. This approach ensures that each organization can design glass tables that best represent their unique infrastructure, applications, and service landscapes, providing a more personalized and relevant operational overview.
D
Explanation:
In Splunk IT Service Intelligence (ITSI), glass tables are fully customizable dashboards that provide a visual representation of an organization’s IT environment, along with the health and status of services and KPIs. Unlike some pre-configured views or dashboards that might come with default setups in various platforms, ITSI does not provide default glass tables out of the box. Instead, users are encouraged to create their own glass tables tailored to their specific monitoring needs and operational views. This approach ensures that each organization can design glass tables that best represent their unique infrastructure, applications, and service landscapes, providing a more personalized and relevant operational overview.