C is the correct answer because teams are a feature of ITSI that allow you to restrict access to service

content in UI views based on user roles. To create separate teams for finance and sales analysts, you

need to create custom roles that inherit from the itoa_analyst role, which has read-only access to ITSI

content. For example, you can create itoa_finance_analyst and itoa_sales_analyst roles that inherit

from itoa_analyst. Then, you need to create custom teams that include these roles and assign them

to the relevant services. For example, you can create a finance team that includes the

itoa_finance_analyst role and assign it to the finance services. Similarly, you can create a sales team

that includes the itoa_sales_analyst role and assign it to the sales services. This way, analysts in each

department can only see their own services and not each other’s. Reference: Create teams in

ITSI, Assign teams to services in ITSI

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/AD

Anomaly detection is a feature of ITSI that uses machine learning to detect when KPI data deviates

from a normal pattern. The following items apply to anomaly detection:

B) A minimum of 24 hours of data is needed for anomaly detection, and a minimum of 4 entities for

cohesive analysis. This ensures that there is enough data to establish a baseline pattern and compare

different entities within a service.

C) Anomaly detection automatically generates notable events when KPI data diverges from the

pattern. You can configure the sensitivity and severity of the anomaly detection alerts and assign

them to episodes or teams. Reference: [Anomaly Detection]

A KPI lane is a type of deep dive swim lane that does not require writing SPL. You can simply select a

service and a KPI from a drop-down list and ITSI will automatically populate the lane with the

corresponding data. You can also adjust the threshold settings and time range for the KPI lane.

Reference: [KPI Lanes]

A is the correct answer because anomaly detection can be enabled on a KPI level in ITSI. Anomaly

detection allows you to identify trends and outliers in KPI search results that might indicate an issue

with your system. You can enable anomaly detection for a KPI by selecting one of the two anomaly

detection algorithms in the KPI configuration panel. Reference: Apply anomaly detection to a KPI in

ITSI

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/DeepDives

C is the correct answer because a default deep dive initially shows all of the KPIs for a selected

service. You can create a default deep dive by drilling down from another dashboard or by selecting a

service from the deep dive lister page. A default deep dive does not show health scores, importance

scores, or entity swim lanes by default. Reference: [Create default deep dives for services in ITSI]

Time policies are user-defined threshold values to be used at different times of the day or week to

account for changing KPI workloads. Time policies accommodate normal variations in usage across

your services and improve the accuracy of KPI and service health scores. For example, if your

organization’s peak activity is during the standard work week, you might create a KPI threshold time

policy that accounts for higher levels of usage during work hours, and lower levels of usage during

off-hours and weekends. The statement that applies when configuring time policies for KPI

thresholds is:

B) They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00.

This is true because time policies allow you to define different threshold values for different time

blocks, such as AM/PM, work hours/off hours, weekdays/weekends, and so on. This way, you can

account for the expected variations in your KPI data based on the time of day or week.

The other statements do not apply because:

A) A person can only configure 24 policies, one for each hour of the day. This is not true because you

can configure more than 24 policies using different time block combinations, such as 3 hour block, 2

hour block, 1 hour block, and so on.

C) If a person expects a KPI to change significantly through a cycle on a daily basis, don’t use it. This is

not true because time policies are designed to handle KPIs that change significantly through a cycle

on a daily basis, such as web traffic volume or CPU load percent.

D) It is possible for multiple time policies to overlap. This is not true because you can only have one

active time policy at any given time. When you create a new time policy, the previous time policy is

overwritten and cannot be recovered.

Reference: Create time-based static KPI thresholds in ITSI

Search results are processed, created, and written to the itsi_summary index via an alert action.

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/BaseSearch

D is the correct answer because KPI search results are stored in the itsi_summary index in ITSI. This

index is an events index that stores the results of scheduled KPI searches. Summary indexing lets you

run fast searches over large data sets by spreading out the cost of a computationally expensive report

over time. Reference: Overview of ITSI indexes

Deep dives in Splunk IT Service Intelligence (ITSI) allow for an in-depth analysis of services and their

KPIs over time, providing a detailed view of the operational health and performance trends. One of

the powerful actions that can be performed with a deep dive is the creation of a Multi-KPI alert from

the deep dive's current state. This functionality enables users to define alerts based on the complex

conditions observed during the deep dive analysis, allowing for the early detection of similar

situations in the future. By configuring a Multi-KPI alert directly from a deep dive, ITSI users can

leverage their insights and observations to proactively monitor for patterns or conditions that may

indicate potential service degradation or failure, enhancing the overall responsiveness and

effectiveness of the IT monitoring strategy.

When creating a custom deep dive, services or KPIs that are in maintenance mode are shown in gray

color in the topology view. This indicates that they are not actively monitored and do not generate

alerts or notable events. Reference: Deep Dives

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/IndexOverview

B is the correct answer because ITSI episodes are stored in the itsi_grouped_alerts index. This index

contains notable events that have been grouped together based on predefined aggregation policies.

Episodes help you reduce alert noise and focus on resolving incidents faster. Reference: [Overview of

episodes in ITSI]