Splunk SPLK-3002 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-3002
- Exam Name: Splunk IT Service Intelligence Certified Admin Exam
- Certification Provider: Splunk
- Latest update: Oct 06,2026
Question #61
Which of the following services often has KPIs but no entities?
- A . Security Service.
- B . Network Service.
- C . Business Service.
- D . Technical Service.
Correct Answer: C
C
Explanation:
In the context of Splunk IT Service Intelligence (ITSI), a Business Service often has Key Performance Indicators (KPIs) but might not have directly associated entities. Business Services represent high-level aggregations of organizational functions or processes and are typically measured by KPIs that reflect the performance of underlying technical services or components rather than direct infrastructure entities .
For example, a Business Service might monitor overall transaction completion times or customer satisfaction scores, which are abstracted from the specific technical entities that underlie these metrics. This abstraction allows Business Services to provide a business-centric view of IT health and performance, focusing on outcomes rather than specific technical components.
C
Explanation:
In the context of Splunk IT Service Intelligence (ITSI), a Business Service often has Key Performance Indicators (KPIs) but might not have directly associated entities. Business Services represent high-level aggregations of organizational functions or processes and are typically measured by KPIs that reflect the performance of underlying technical services or components rather than direct infrastructure entities .
For example, a Business Service might monitor overall transaction completion times or customer satisfaction scores, which are abstracted from the specific technical entities that underlie these metrics. This abstraction allows Business Services to provide a business-centric view of IT health and performance, focusing on outcomes rather than specific technical components.
Question #62
What can a KPI widget on a glass table drill down into?
- A . Another glass table.
- B . A Splunk dashboard.
- C . A custom deep dive.
- D . Any of the above.
Correct Answer: D
D
Explanation:
In Splunk IT Service Intelligence (ITSI), a KPI widget on a glass table can be configured to drill down into a variety of destinations based on the needs of the user and the design of the glass table. This flexibility allows users to dive deeper into the data or analysis represented by the KPI widget, providing context and additional insights.
The destinations for drill-downs from a KPI widget can include:
A) Another glass table, offering a different perspective or more detailed view related to the KPI.
B. A Splunk dashboard that provides broader analysis or incorporates data from multiple sources.
C. A custom deep dive for in-depth, time-series analysis of the KPI and related metrics.
This versatility makes KPI widgets powerful tools for navigating through the wealth of operational data and insights available in ITSI, facilitating effective monitoring and decision-making.
D
Explanation:
In Splunk IT Service Intelligence (ITSI), a KPI widget on a glass table can be configured to drill down into a variety of destinations based on the needs of the user and the design of the glass table. This flexibility allows users to dive deeper into the data or analysis represented by the KPI widget, providing context and additional insights.
The destinations for drill-downs from a KPI widget can include:
A) Another glass table, offering a different perspective or more detailed view related to the KPI.
B. A Splunk dashboard that provides broader analysis or incorporates data from multiple sources.
C. A custom deep dive for in-depth, time-series analysis of the KPI and related metrics.
This versatility makes KPI widgets powerful tools for navigating through the wealth of operational data and insights available in ITSI, facilitating effective monitoring and decision-making.
Question #62
What can a KPI widget on a glass table drill down into?
- A . Another glass table.
- B . A Splunk dashboard.
- C . A custom deep dive.
- D . Any of the above.
Correct Answer: D
D
Explanation:
In Splunk IT Service Intelligence (ITSI), a KPI widget on a glass table can be configured to drill down into a variety of destinations based on the needs of the user and the design of the glass table. This flexibility allows users to dive deeper into the data or analysis represented by the KPI widget, providing context and additional insights.
The destinations for drill-downs from a KPI widget can include:
A) Another glass table, offering a different perspective or more detailed view related to the KPI.
B. A Splunk dashboard that provides broader analysis or incorporates data from multiple sources.
C. A custom deep dive for in-depth, time-series analysis of the KPI and related metrics.
This versatility makes KPI widgets powerful tools for navigating through the wealth of operational data and insights available in ITSI, facilitating effective monitoring and decision-making.
D
Explanation:
In Splunk IT Service Intelligence (ITSI), a KPI widget on a glass table can be configured to drill down into a variety of destinations based on the needs of the user and the design of the glass table. This flexibility allows users to dive deeper into the data or analysis represented by the KPI widget, providing context and additional insights.
The destinations for drill-downs from a KPI widget can include:
A) Another glass table, offering a different perspective or more detailed view related to the KPI.
B. A Splunk dashboard that provides broader analysis or incorporates data from multiple sources.
C. A custom deep dive for in-depth, time-series analysis of the KPI and related metrics.
This versatility makes KPI widgets powerful tools for navigating through the wealth of operational data and insights available in ITSI, facilitating effective monitoring and decision-making.
Question #64
In distributed search, which components need to be installed on instances other than the search head?
- A . SA-IndexCreation and SA-ITSI-Licensechecker on indexers.
- B . SA-IndexCreation and SA-ITOA on indexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
- C . SA-IndexCreation on idexers; SA-ITSI-Licensechecker and SA-UserAccess on the license master.
- D . SA-ITSI-Licensechecker on indexers.
Correct Answer: A
A
Explanation:
SA-IndexCreation is required on all indexers. For non-clustered, distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Install/InstallDD
In distributed search, the components that need to be installed on instances other than the search head are SA-IndexCreation and SA-ITSI-Licensechecker on indexers. SA-IndexCreation is an add-on that creates the indexes required by ITSI, such as itsi_summary and itsi_tracked_alerts. SA-ITSI-Licensechecker is an add-on that monitors the license usage of ITSI and generates alerts when the license limit is exceeded or about to expire. These components need to be installed on indexers because they handle the data ingestion and storage functions for ITSI. The other components, such
as ITSI app and SA-ITOA, need to be installed on the search head(s) because they handle the search management and presentation functions for ITSI.
Reference: Install IT Service Intelligence in a distributed environment
A
Explanation:
SA-IndexCreation is required on all indexers. For non-clustered, distributed environments, copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on individual indexers.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Install/InstallDD
In distributed search, the components that need to be installed on instances other than the search head are SA-IndexCreation and SA-ITSI-Licensechecker on indexers. SA-IndexCreation is an add-on that creates the indexes required by ITSI, such as itsi_summary and itsi_tracked_alerts. SA-ITSI-Licensechecker is an add-on that monitors the license usage of ITSI and generates alerts when the license limit is exceeded or about to expire. These components need to be installed on indexers because they handle the data ingestion and storage functions for ITSI. The other components, such
as ITSI app and SA-ITOA, need to be installed on the search head(s) because they handle the search management and presentation functions for ITSI.
Reference: Install IT Service Intelligence in a distributed environment
Question #65
When troubleshooting KPI search performance, which search names in job activity identify base searches?
- A . Indicator – XXXX – Base Search
- B . Indicator – Shared – xxxx – ITSI Search
- C . Indicator – Base – xxxx – ITSI Search
- D . Indicator – Base – XXXX – Shared Search
Correct Answer: B
B
Explanation:
In the context of troubleshooting KPI search performance in Splunk IT Service Intelligence (ITSI), the search names in the job activity that identify base searches typically follow the pattern "Indicator – Shared – xxxx – ITSI Search." These base searches are fundamental components of the KPI calculation process, aggregating and preparing data for further analysis by KPIs. Identifying these base searches in the job activity is crucial for diagnosing performance issues, as these searches can be resource-intensive and impact overall system performance. Understanding the naming convention helps administrators and analysts quickly pinpoint the base searches related to specific KPIs, facilitating more effective troubleshooting and optimization of search performance within the ITSI environment.
B
Explanation:
In the context of troubleshooting KPI search performance in Splunk IT Service Intelligence (ITSI), the search names in the job activity that identify base searches typically follow the pattern "Indicator – Shared – xxxx – ITSI Search." These base searches are fundamental components of the KPI calculation process, aggregating and preparing data for further analysis by KPIs. Identifying these base searches in the job activity is crucial for diagnosing performance issues, as these searches can be resource-intensive and impact overall system performance. Understanding the naming convention helps administrators and analysts quickly pinpoint the base searches related to specific KPIs, facilitating more effective troubleshooting and optimization of search performance within the ITSI environment.
Question #66
Which of the following accurately describes base searches used for KPIs in a service?
- A . Base searches can be used for multiple services.
- B . A base search can only be used by its service and all dependent services.
- C . All the metrics in a base search are used by one service.
- D . All the KPIs in a service use the same base search.
Correct Answer: A
A
Explanation:
KPI base searches let you share a search definition across multiple KPIs in IT Service Intelligence (ITSI). Create base searches to consolidate multiple similar KPIs, reduce search load, and improve search performance.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/BaseSearch
A base search is a search definition that can be shared across multiple KPIs that use the same data source. Base searches can improve search performance and reduce search load by consolidating multiple similar KPIs.
The statement that accurately describes base searches used for KPIs in a service is:
A) Base searches can be used for multiple services. This means that you can create a base search for a service and use it for other services that have similar data sources and KPIs .
For example, if you have multiple services that monitor web server performance, you can create a base search that queries the web server logs and use it for all the services that need to calculate KPIs based on those logs.
A
Explanation:
KPI base searches let you share a search definition across multiple KPIs in IT Service Intelligence (ITSI). Create base searches to consolidate multiple similar KPIs, reduce search load, and improve search performance.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/BaseSearch
A base search is a search definition that can be shared across multiple KPIs that use the same data source. Base searches can improve search performance and reduce search load by consolidating multiple similar KPIs.
The statement that accurately describes base searches used for KPIs in a service is:
A) Base searches can be used for multiple services. This means that you can create a base search for a service and use it for other services that have similar data sources and KPIs .
For example, if you have multiple services that monitor web server performance, you can create a base search that queries the web server logs and use it for all the services that need to calculate KPIs based on those logs.
Question #67
When in maintenance mode, which of the following is accurate?
- A . Once the window is over, KPIs and notable events will begin to be generated again.
- B . KPIs are shown in blue while in maintenance mode.
- C . Maintenance mode slots are scheduled on a per hour basis.
- D . Service health scores and KPI events are deleted until the window is over.
Correct Answer: A
A
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/REBestPractice
A is the correct answer because when in maintenance mode, KPIs and notable events will begin to be generated again once the window is over. Maintenance mode is a feature of ITSI that allows you to temporarily suspend alerts and health score calculations for a service or an entity during planned maintenance or downtime. During maintenance mode, KPI searches still run, but the results are buffered until the window is over. Once the window is over, the buffered results are processed and alerts and health scores are generated if necessary.
Reference: [Overview of maintenance windows in ITSI]
A
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/REBestPractice
A is the correct answer because when in maintenance mode, KPIs and notable events will begin to be generated again once the window is over. Maintenance mode is a feature of ITSI that allows you to temporarily suspend alerts and health score calculations for a service or an entity during planned maintenance or downtime. During maintenance mode, KPI searches still run, but the results are buffered until the window is over. Once the window is over, the buffered results are processed and alerts and health scores are generated if necessary.
Reference: [Overview of maintenance windows in ITSI]
Question #68
What is an episode?
- A . A workflow task.
- B . A deep dive.
- C . A notable event group.
- D . A notable event.
Correct Answer: C
C
Explanation:
It’s a deduplicated group of notable events occurring as part of a larger sequence, or an incident or period considered in isolation.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/EpisodeOverview
An episode is a deduplicated group of notable events occurring as part of a larger sequence, or an incident or period considered in isolation. An episode helps you reduce alert noise and focus on the most important issues affecting your IT services. An episode is created by an aggregation policy, which is a set of rules that determines how to group notable events based on certain criteria, such as severity, source, title, and so on. You can use episode review to view, manage, and resolve episodes in ITSI. The statement that defines an episode is:
C) A notable event group. This is true because an episode is composed of one or more notable events that are related by some common factor.
The other options are not definitions of an episode because:
A) A workflow task. This is not true because a workflow task is an action that you can perform on an
episode, such as assigning an owner, changing the status, adding comments, and so on.
B) A deep dive. This is not true because a deep dive is a dashboard that allows you to analyze the historical trends and anomalies of your KPIs and metrics in ITSI.
D) A notable event. This is not true because a notable event is an alert generated by ITSI based on certain conditions or correlations, not a group of alerts.
Reference: [Overview of Episode Review in ITSI], [Overview of aggregation policies in ITSI]
C
Explanation:
It’s a deduplicated group of notable events occurring as part of a larger sequence, or an incident or period considered in isolation.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/EpisodeOverview
An episode is a deduplicated group of notable events occurring as part of a larger sequence, or an incident or period considered in isolation. An episode helps you reduce alert noise and focus on the most important issues affecting your IT services. An episode is created by an aggregation policy, which is a set of rules that determines how to group notable events based on certain criteria, such as severity, source, title, and so on. You can use episode review to view, manage, and resolve episodes in ITSI. The statement that defines an episode is:
C) A notable event group. This is true because an episode is composed of one or more notable events that are related by some common factor.
The other options are not definitions of an episode because:
A) A workflow task. This is not true because a workflow task is an action that you can perform on an
episode, such as assigning an owner, changing the status, adding comments, and so on.
B) A deep dive. This is not true because a deep dive is a dashboard that allows you to analyze the historical trends and anomalies of your KPIs and metrics in ITSI.
D) A notable event. This is not true because a notable event is an alert generated by ITSI based on certain conditions or correlations, not a group of alerts.
Reference: [Overview of Episode Review in ITSI], [Overview of aggregation policies in ITSI]
Question #69
What features does a maintenance window in ITSI provide? (Choose two)
- A . Automatic backup of event data
- B . Suppression of alerts
- C . Adjustment of KPI thresholds
- D . Temporary pausing of data collection
Correct Answer: B, D
Question #70
Which of the following are components of a deep dive in ITSI? (Choose three)
- A . Swim lanes
- B . Thresholds
- C . Event annotations
- D . Aggregation policies
Correct Answer: A, B, C