Free SPLK-3002 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

C is the correct answer because teams are a feature of ITSI that allow you to restrict access to service

content in UI views based on user roles. To create separate teams for finance and sales analysts, you

need to create custom roles that inherit from the itoa_analyst role, which has read-only access to ITSI

content. For example, you can create itoa_finance_analyst and itoa_sales_analyst roles that inherit

from itoa_analyst. Then, you need to create custom teams that include these roles and assign them

to the relevant services. For example, you can create a finance team that includes the

itoa_finance_analyst role and assign it to the finance services. Similarly, you can create a sales team

that includes the itoa_sales_analyst role and assign it to the sales services. This way, analysts in each

department can only see their own services and not each other’s. Reference: Create teams in

ITSI, Assign teams to services in ITSI

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/AD

Anomaly detection is a feature of ITSI that uses machine learning to detect when KPI data deviates

from a normal pattern. The following items apply to anomaly detection:

B) A minimum of 24 hours of data is needed for anomaly detection, and a minimum of 4 entities for

cohesive analysis. This ensures that there is enough data to establish a baseline pattern and compare

different entities within a service.

C) Anomaly detection automatically generates notable events when KPI data diverges from the

pattern. You can configure the sensitivity and severity of the anomaly detection alerts and assign

them to episodes or teams. Reference: [Anomaly Detection]

A KPI lane is a type of deep dive swim lane that does not require writing SPL. You can simply select a

service and a KPI from a drop-down list and ITSI will automatically populate the lane with the

corresponding data. You can also adjust the threshold settings and time range for the KPI lane.

Reference: [KPI Lanes]

A is the correct answer because anomaly detection can be enabled on a KPI level in ITSI. Anomaly

detection allows you to identify trends and outliers in KPI search results that might indicate an issue

with your system. You can enable anomaly detection for a KPI by selecting one of the two anomaly

detection algorithms in the KPI configuration panel. Reference: Apply anomaly detection to a KPI in

ITSI

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/DeepDives

C is the correct answer because a default deep dive initially shows all of the KPIs for a selected

service. You can create a default deep dive by drilling down from another dashboard or by selecting a

service from the deep dive lister page. A default deep dive does not show health scores, importance

scores, or entity swim lanes by default. Reference: [Create default deep dives for services in ITSI]

Time policies are user-defined threshold values to be used at different times of the day or week to

account for changing KPI workloads. Time policies accommodate normal variations in usage across

your services and improve the accuracy of KPI and service health scores. For example, if your

organization’s peak activity is during the standard work week, you might create a KPI threshold time

policy that accounts for higher levels of usage during work hours, and lower levels of usage during

off-hours and weekends. The statement that applies when configuring time policies for KPI

thresholds is:

B) They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00.

This is true because time policies allow you to define different threshold values for different time

blocks, such as AM/PM, work hours/off hours, weekdays/weekends, and so on. This way, you can

account for the expected variations in your KPI data based on the time of day or week.

The other statements do not apply because:

A) A person can only configure 24 policies, one for each hour of the day. This is not true because you

can configure more than 24 policies using different time block combinations, such as 3 hour block, 2

hour block, 1 hour block, and so on.

C) If a person expects a KPI to change significantly through a cycle on a daily basis, don’t use it. This is

not true because time policies are designed to handle KPIs that change significantly through a cycle

on a daily basis, such as web traffic volume or CPU load percent.

D) It is possible for multiple time policies to overlap. This is not true because you can only have one

active time policy at any given time. When you create a new time policy, the previous time policy is

overwritten and cannot be recovered.

Reference: Create time-based static KPI thresholds in ITSI

Search results are processed, created, and written to the itsi_summary index via an alert action.

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/BaseSearch

D is the correct answer because KPI search results are stored in the itsi_summary index in ITSI. This

index is an events index that stores the results of scheduled KPI searches. Summary indexing lets you

run fast searches over large data sets by spreading out the cost of a computationally expensive report

over time. Reference: Overview of ITSI indexes

Deep dives in Splunk IT Service Intelligence (ITSI) allow for an in-depth analysis of services and their

KPIs over time, providing a detailed view of the operational health and performance trends. One of

the powerful actions that can be performed with a deep dive is the creation of a Multi-KPI alert from

the deep dive's current state. This functionality enables users to define alerts based on the complex

conditions observed during the deep dive analysis, allowing for the early detection of similar

situations in the future. By configuring a Multi-KPI alert directly from a deep dive, ITSI users can

leverage their insights and observations to proactively monitor for patterns or conditions that may

indicate potential service degradation or failure, enhancing the overall responsiveness and

effectiveness of the IT monitoring strategy.

When creating a custom deep dive, services or KPIs that are in maintenance mode are shown in gray

color in the topology view. This indicates that they are not actively monitored and do not generate

alerts or notable events. Reference: Deep Dives

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/IndexOverview

B is the correct answer because ITSI episodes are stored in the itsi_grouped_alerts index. This index

contains notable events that have been grouped together based on predefined aggregation policies.

Episodes help you reduce alert noise and focus on resolving incidents faster. Reference: [Overview of

episodes in ITSI]

It's a deduplicated group of notable events occurring as part of a larger sequence, or an incident or

period considered in isolation.

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/EA/EpisodeOverview

An episode is a deduplicated group of notable events occurring as part of a larger sequence, or an

incident or period considered in isolation. An episode helps you reduce alert noise and focus on the

most important issues affecting your IT services. An episode is created by an aggregation policy,

which is a set of rules that determines how to group notable events based on certain criteria, such as

severity, source, title, and so on. You can use episode review to view, manage, and resolve episodes

in ITSI. The statement that defines an episode is:

C) A notable event group. This is true because an episode is composed of one or more notable events

that are related by some common factor.

The other options are not definitions of an episode because:

A) A workflow task. This is not true because a workflow task is an action that you can perform on an

episode, such as assigning an owner, changing the status, adding comments, and so on.

B) A deep dive. This is not true because a deep dive is a dashboard that allows you to analyze the

historical trends and anomalies of your KPIs and metrics in ITSI.

D) A notable event. This is not true because a notable event is an alert generated by ITSI based on

certain conditions or correlations, not a group of alerts.

Reference: [Overview of Episode Review in ITSI], [Overview of aggregation policies in ITSI]

In Splunk IT Service Intelligence (ITSI), creating teams for each department and assigning services to

those teams is an effective way to segregate data and ensure that information remains private

between different groups within an organization. Teams in ITSI provide a mechanism for role-based

access control, allowing administrators to define which users or groups have access to specific

services, KPIs, and dashboards. By setting up teams corresponding to each department and then

assigning services to these teams, ITSI can accommodate multi-departmental use within the same

instance while maintaining strict access controls. This ensures that each department can only view

and interact with the data and services relevant to their operations, preserving confidentiality and

data integrity across the organization.

Copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on all individual indexers in your environment.

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Install/InstallSHC

A is the correct answer because when installing ITSI to support a distributed search architecture, you

need to copy SA-IndexCreation to all indexers. SA-IndexCreation is an app that contains the

definitions of the ITSI indexes, such as itsi_summary, itsi_tracked_alerts, itsi_grouped_alerts, etc. You

need to copy this app to all indexers to ensure that they can store and search the ITSI data. B is not a

correct answer because you do not need to copy SA-IndexCreation to the etc/apps directory on the

index cluster master node. The index cluster master node does not store or search data, it only

manages the replication and availability of data across the index cluster peers. C is not a correct

answer because you do not need to extract the installer package into etc/apps directory of the cluster

deployer node. The cluster deployer node is used to distribute apps and configuration updates to the

search head cluster members. You need to extract the installer package into etc/shcluster/apps

directory of the cluster deployer node instead. D is not a correct answer because you do not need to

extract the ITSI app package into etc/apps directory of search head. You need to extract the ITSI app

package into etc/shcluster/apps directory of the cluster deployer node and use the deployer to push

the app to all search head cluster members. Reference: [Install Splunk IT Service Intelligence on a

search head cluster], [Install Splunk IT Service Intelligence on an indexer cluster]

In the context of Splunk IT Service Intelligence (ITSI), service dependencies allow for the modeling of

relationships between services, where the health of one service (dependent) can affect the health of

another (primary).

B) It is best practice to use the dependent service's built-in 'ServiceHealthScore' KPI to reflect impact

to the primary service: Utilizing the 'ServiceHealthScore' KPI of a dependent service as part of the

primary service's health calculation is a recommended practice. This approach ensures that changes

in the health of the dependent service directly influence the primary service's overall health score,

providing a more holistic view of service health within the IT environment.

C) Setting the dependent service KPI importance level will be treated as any other KPI in the primary

service's health score: When a dependent service's KPI is incorporated into a primary service, the

importance level assigned to this KPI is factored into the primary service's overall health score

calculation just like any other KPI. This means that the impact of the dependent service on the

primary service can be weighted according to the business significance of the relationship between

the services.

The other options are not accurate representations of ITSI service dependencies. Changes in KPI

importance levels do not break dependencies, and there is no restriction on configuring impactful

dependent services to only one primary service, as dependencies can be complex and multi-layered

across various services.

It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and

after you start and stop your maintenance work. This gives the system an opportunity to catch up

with the maintenance state and reduces the chances of ITSI generating false positives during

maintenance operations.

Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/Configure/AboutMW

A is the correct answer because KPI searches still run during maintenance mode, but the results are

buffered until the maintenance window is over. This means that no alerts are triggered during

maintenance mode, but once it ends, the buffered results are processed and alerts are generated if

necessary. You cannot create new KPIs or modify existing KPIs during maintenance mode. Reference:

[Overview of maintenance windows in ITSI]