Splunk SPLK-3002 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-3002
- Exam Name: Splunk IT Service Intelligence Certified Admin Exam
- Certification Provider: Splunk
- Latest update: Oct 06,2026
Question #81
Which of the following describes entities? (Choose all that apply.)
- A . Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.
- B . An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.
- C . Multiple entities can share the same alias value, but must have different role values.
- D . To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in Service”.
Correct Answer: BD
BD
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/KPIfilter
Entities are IT components that require management to deliver an IT service. Each entity has specific attributes and relationships to other IT processes that uniquely identify it. Entities contain alias fields and informational fields that ITSI associates with indexed events.
Some statements that describe entities are:
B) An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service. An abstract entity is an entity that does not represent a physical host or device, but rather a logical grouping of data sources .
For example, you can create an abstract entity for each business unit in your organization and use it to split by for a KPI that measures revenue or customer satisfaction. However, you cannot use entity rules or filtering to limit data to a specific service based on abstract entities, because they do not have alias fields that match indexed events.
D) To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in Service”. This option allows you to filter the data sources for a KPI by the entities that are assigned to the service .
For example, if you have a service for web servers and you want to monitor the CPU load percent for each web server entity, you can select this option to ensure that only the events from those entities are used for the KPI calculation.
Reference: Overview of entity integrations in ITSI, [Create KPI base searches in ITSI]
BD
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/KPIfilter
Entities are IT components that require management to deliver an IT service. Each entity has specific attributes and relationships to other IT processes that uniquely identify it. Entities contain alias fields and informational fields that ITSI associates with indexed events.
Some statements that describe entities are:
B) An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service. An abstract entity is an entity that does not represent a physical host or device, but rather a logical grouping of data sources .
For example, you can create an abstract entity for each business unit in your organization and use it to split by for a KPI that measures revenue or customer satisfaction. However, you cannot use entity rules or filtering to limit data to a specific service based on abstract entities, because they do not have alias fields that match indexed events.
D) To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in Service”. This option allows you to filter the data sources for a KPI by the entities that are assigned to the service .
For example, if you have a service for web servers and you want to monitor the CPU load percent for each web server entity, you can select this option to ensure that only the events from those entities are used for the KPI calculation.
Reference: Overview of entity integrations in ITSI, [Create KPI base searches in ITSI]
Question #82
In which index are active notable events stored?
- A . itsi_notable_archive
- B . itsi_notable_audit
- C . itsi_tracked_alerts
- D . itsi_tracked_groups
Correct Answer: C
C
Explanation:
In Splunk IT Service Intelligence (ITSI), notable events are created and managed within the context of its Event Analytics framework. These notable events are stored in the itsi_tracked_alerts index. This index is specifically designed to hold the active notable events that are generated by ITSI’s correlation searches, which are based on the conditions defined for various services and their KPIs.
Notable events are essentially alerts or issues that need to be investigated and resolved. The itsi_tracked_alerts index enables efficient storage, querying, and management of these events, facilitating the ITSI’s event management and review process. The other options, such as itsi_notable_archive and itsi_notable_audit, serve different purposes, such as archiving resolved notable events and auditing changes to notable event configurations, respectively. Therefore, the correct answer for where active notable events are stored is the itsi_tracked_alerts index.
C
Explanation:
In Splunk IT Service Intelligence (ITSI), notable events are created and managed within the context of its Event Analytics framework. These notable events are stored in the itsi_tracked_alerts index. This index is specifically designed to hold the active notable events that are generated by ITSI’s correlation searches, which are based on the conditions defined for various services and their KPIs.
Notable events are essentially alerts or issues that need to be investigated and resolved. The itsi_tracked_alerts index enables efficient storage, querying, and management of these events, facilitating the ITSI’s event management and review process. The other options, such as itsi_notable_archive and itsi_notable_audit, serve different purposes, such as archiving resolved notable events and auditing changes to notable event configurations, respectively. Therefore, the correct answer for where active notable events are stored is the itsi_tracked_alerts index.
Question #83
Which of the following is a good use case regarding defining entities for a service?
- A . Automatically associate entities to services using multiple entity aliases.
- B . All of the entities have the same identifying field name.
- C . Being able to split a CPU usage KPI by host name.
- D . KPI total values are aggregated from multiple different category values in the source events.
Correct Answer: A
A
Explanation:
Define entities before creating services. When you configure a service, you can specify entity matching rules based on entity aliases that automatically add the entities to your service.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Entity/About
A is the correct answer because defining entities for a service allows you to automatically associate entities to services using multiple entity aliases. Entity aliases are alternative names or identifiers for an entity, such as host name, IP address, MAC address, or DNS name. ITSI matches entity aliases to fields in your data sources and assigns entities to services accordingly. This way, you can avoid manually adding entities to each service and ensure that your services reflect the latest changes in your environment.
Reference: Define entities for a service in ITSI
A
Explanation:
Define entities before creating services. When you configure a service, you can specify entity matching rules based on entity aliases that automatically add the entities to your service.
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Entity/About
A is the correct answer because defining entities for a service allows you to automatically associate entities to services using multiple entity aliases. Entity aliases are alternative names or identifiers for an entity, such as host name, IP address, MAC address, or DNS name. ITSI matches entity aliases to fields in your data sources and assigns entities to services accordingly. This way, you can avoid manually adding entities to each service and ensure that your services reflect the latest changes in your environment.
Reference: Define entities for a service in ITSI
Question #84
Which anomaly detection algorithm is included within ITSI?
- A . Entity cohesion
- B . Standard deviation
- C . Linear regression
- D . Infantile regression
Correct Answer: A
A
Explanation:
Among the anomaly detection algorithms included within Splunk IT Service Intelligence (ITSI), "Entity Cohesion" is a notable option. The Entity Cohesion algorithm is designed to detect anomalies by comparing the behavior of one entity against the collective behavior of a group of similar entities. This approach is particularly useful in scenarios where entities are expected to exhibit similar patterns of behavior under normal conditions. Anomalies are identified when an entity’s metrics deviate significantly from the group norm, suggesting a potential issue with that specific entity. This method leverages the concept of cohesion among similar entities to enhance the accuracy and relevance of anomaly detection within ITSI environments.
A
Explanation:
Among the anomaly detection algorithms included within Splunk IT Service Intelligence (ITSI), "Entity Cohesion" is a notable option. The Entity Cohesion algorithm is designed to detect anomalies by comparing the behavior of one entity against the collective behavior of a group of similar entities. This approach is particularly useful in scenarios where entities are expected to exhibit similar patterns of behavior under normal conditions. Anomalies are identified when an entity’s metrics deviate significantly from the group norm, suggesting a potential issue with that specific entity. This method leverages the concept of cohesion among similar entities to enhance the accuracy and relevance of anomaly detection within ITSI environments.
Question #85
For which ITSI function is it a best practice to use a 15-30 minute time buffer?
- A . Correlation searches.
- B . Adaptive thresholding.
- C . Maintenance windows
- D . Anomaly detection.
Correct Answer: B
B
Explanation:
B is the correct answer because adaptive thresholding is a feature of ITSI that allows you to dynamically adjust KPI thresholds based on historical patterns and trends. Adaptive thresholding requires a time buffer of at least 15 minutes to calculate the thresholds based on the previous data points. The time buffer ensures that there is enough data to perform the calculations and avoid false positives or negatives.
Reference: Configure adaptive thresholding for a KPI in ITSI
B
Explanation:
B is the correct answer because adaptive thresholding is a feature of ITSI that allows you to dynamically adjust KPI thresholds based on historical patterns and trends. Adaptive thresholding requires a time buffer of at least 15 minutes to calculate the thresholds based on the previous data points. The time buffer ensures that there is enough data to perform the calculations and avoid false positives or negatives.
Reference: Configure adaptive thresholding for a KPI in ITSI
Question #86
There are two departments using ITSI. Finance and Sales. Analysts in each department should not be allowed to see each other’s services.
What are the role configuration steps required to accomplish this?
- A . itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.
- B . itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_team_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.
- C . itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.
- D . itoa_finance_admin, inherited from itoa_team_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.
Correct Answer: C
C
Explanation:
C is the correct answer because teams are a feature of ITSI that allow you to restrict access to service content in UI views based on user roles. To create separate teams for finance and sales analysts, you need to create custom roles that inherit from the itoa_analyst role, which has read-only access to ITSI content .
For example, you can create itoa_finance_analyst and itoa_sales_analyst roles that inherit from itoa_analyst. Then, you need to create custom teams that include these roles and assign them to the relevant services .
For example, you can create a finance team that includes the itoa_finance_analyst role and assign it to the finance services. Similarly, you can create a sales team that includes the itoa_sales_analyst role and assign it to the sales services. This way, analysts in each department can only see their own services and not each other’s.
Reference: Create teams in
ITSI, Assign teams to services in ITSI
C
Explanation:
C is the correct answer because teams are a feature of ITSI that allow you to restrict access to service content in UI views based on user roles. To create separate teams for finance and sales analysts, you need to create custom roles that inherit from the itoa_analyst role, which has read-only access to ITSI content .
For example, you can create itoa_finance_analyst and itoa_sales_analyst roles that inherit from itoa_analyst. Then, you need to create custom teams that include these roles and assign them to the relevant services .
For example, you can create a finance team that includes the itoa_finance_analyst role and assign it to the finance services. Similarly, you can create a sales team that includes the itoa_sales_analyst role and assign it to the sales services. This way, analysts in each department can only see their own services and not each other’s.
Reference: Create teams in
ITSI, Assign teams to services in ITSI
Question #87
Within a correlation search, dynamic field values can be specified with what syntax?
- A . fieldname
- B . <fieldname /fieldname>
- C . %fieldname%
- D . eval(fieldname)
Correct Answer: B
B
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/Searchindexes
B is the correct answer because dynamic field values can be specified with <fieldname /fieldname> syntax within a correlation search. This syntax allows you to insert values from fields returned by the correlation search into alert actions such as email subject or body .
For example, <host /host> inserts the value of the host field into the email.
Reference: [Use dynamic field values in correlation searches in ITSI]
B
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/Searchindexes
B is the correct answer because dynamic field values can be specified with <fieldname /fieldname> syntax within a correlation search. This syntax allows you to insert values from fields returned by the correlation search into alert actions such as email subject or body .
For example, <host /host> inserts the value of the host field into the email.
Reference: [Use dynamic field values in correlation searches in ITSI]
Question #88
Which index contains ITSI Episodes?
- A . itsi_tracked_alerts
- B . itsi_grouped_alerts
- C . itsi_notable_archive
- D . itsi_summary
Correct Answer: B
B
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/IndexOverview
B is the correct answer because ITSI episodes are stored in the itsi_grouped_alerts index. This index contains notable events that have been grouped together based on predefined aggregation policies. Episodes help you reduce alert noise and focus on resolving incidents faster.
Reference: [Overview of episodes in ITSI]
B
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/IndexOverview
B is the correct answer because ITSI episodes are stored in the itsi_grouped_alerts index. This index contains notable events that have been grouped together based on predefined aggregation policies. Episodes help you reduce alert noise and focus on resolving incidents faster.
Reference: [Overview of episodes in ITSI]
Question #89
What is the main purpose of the service analyzer?
- A . Display a list of All Services and Entities.
- B . Trigger external alerts based on threshold violations.
- C . Allow Analysts to add comments to Alerts.
- D . Monitor overall Service and KPI status.
Correct Answer: D
D
Explanation:
Reference: https://docs.splunk.com/Documentation/MSExchange/4.0.3/Reference/ServiceAnalyzer The service analyzer is a dashboard that allows you to monitor the overall service and KPI status in ITSI. The service analyzer displays a list of all services and their health scores, which indicate how well each service is performing based on its KPIs. You can also view the status and values of each KPI within a service, as well as drill down into deep dives or glass tables for further analysis. The service analyzer helps you identify issues affecting your services and prioritize them based on their impact and urgency.
The main purpose of the service analyzer is:
D) Monitor overall service and KPI status. This is true because the service analyzer provides a comprehensive view of the health and performance of your services and KPIs in real time. The other options are not the main purpose of the service analyzer because:
A) Display a list of all services and entities. This is not true because the service analyzer does not display entities, which are IT components that require management to deliver an IT service. Entities are displayed in other dashboards, such as entity management or entity health overview.
B) Trigger external alerts based on threshold violations. This is not true because the service analyzer does not trigger alerts, which are notifications sent to external systems or users when certain conditions are met. Alerts are triggered by correlation searches or alert actions configured in ITSI.
C) Allow analysts to add comments to alerts. This is not true because the service analyzer does not allow analysts to add comments to alerts, which are notifications sent to external systems or users
D
Explanation:
Reference: https://docs.splunk.com/Documentation/MSExchange/4.0.3/Reference/ServiceAnalyzer The service analyzer is a dashboard that allows you to monitor the overall service and KPI status in ITSI. The service analyzer displays a list of all services and their health scores, which indicate how well each service is performing based on its KPIs. You can also view the status and values of each KPI within a service, as well as drill down into deep dives or glass tables for further analysis. The service analyzer helps you identify issues affecting your services and prioritize them based on their impact and urgency.
The main purpose of the service analyzer is:
D) Monitor overall service and KPI status. This is true because the service analyzer provides a comprehensive view of the health and performance of your services and KPIs in real time. The other options are not the main purpose of the service analyzer because:
A) Display a list of all services and entities. This is not true because the service analyzer does not display entities, which are IT components that require management to deliver an IT service. Entities are displayed in other dashboards, such as entity management or entity health overview.
B) Trigger external alerts based on threshold violations. This is not true because the service analyzer does not trigger alerts, which are notifications sent to external systems or users when certain conditions are met. Alerts are triggered by correlation searches or alert actions configured in ITSI.
C) Allow analysts to add comments to alerts. This is not true because the service analyzer does not allow analysts to add comments to alerts, which are notifications sent to external systems or users
Question #90
When a KPI’s aggregate value is calculated, which function is called?
- A . stats
- B . tstats
- C . fieldsummary
- D . eval
Correct Answer: B
B
Explanation:
In Splunk IT Service Intelligence (ITSI), when a Key Performance Indicator (KPI) aggregate value is calculated, the tstats function is often called. The tstats function in Splunk is used for rapid statistical queries over large volumes of data, which is particularly useful in ITSI for efficiently calculating aggregate values of KPIs across potentially vast datasets. This function allows for quick aggregation and summarization of indexed data, which is essential for monitoring and analyzing the performance metrics that KPIs represent in ITSI. Unlike the stats command, which operates on already retrieved events, tstats works directly on indexed data, providing faster performance especially when dealing with high volumes of data typical in an IT environment. The tstats command is therefore fundamental in the backend processing of ITSI for calculating aggregate values of KPIs, enabling real-time and historical analysis of service health and performance.
B
Explanation:
In Splunk IT Service Intelligence (ITSI), when a Key Performance Indicator (KPI) aggregate value is calculated, the tstats function is often called. The tstats function in Splunk is used for rapid statistical queries over large volumes of data, which is particularly useful in ITSI for efficiently calculating aggregate values of KPIs across potentially vast datasets. This function allows for quick aggregation and summarization of indexed data, which is essential for monitoring and analyzing the performance metrics that KPIs represent in ITSI. Unlike the stats command, which operates on already retrieved events, tstats works directly on indexed data, providing faster performance especially when dealing with high volumes of data typical in an IT environment. The tstats command is therefore fundamental in the backend processing of ITSI for calculating aggregate values of KPIs, enabling real-time and historical analysis of service health and performance.