Splunk SPLK-3002 - Splunk IT Service Intelligence Certified Admin Exam

Search results are processed, created, and written to the itsi_summary index via an alert action. 

1. From the ITSI main menu, click Configuration > Notable Event Aggregation Policies.

2. Select a custom policy or the Default Policy.

3. Under Smart Mode grouping, enable Smart Mode.

4. Click Select fields. A dialog displays the fields found in your notable events from the last 24 hours.

A realistic troubleshooting workflow in ITSI is:

B. Service Analyzer –> Notable Event Review –> Deep Dive

This workflow involves using the Service Analyzer dashboard to monitor the health and performance of your services and KPIs, using the Notable Event Review dashboard to investigate and manage the notable events generated by ITSI, and using the Deep Dive dashboard to analyze the historical trends and anomalies of your KPIs and metrics.

The other workflows are not realistic because they involve components that are not part of the troubleshooting process, such as correlation search, aggregation policy, and KPI. These components are used to create and configure the alerts and episodes that ITSI generates, not to investigate and resolve them. References: [Service Analyzer dashboard in ITSI], Overview of Episode Review in ITSI, [Overview of deep dives in ITSI]

Splunk ITSI offers two built‑in anomaly detection algorithms:TrendingandEntity Cohesion. TheTrendingalgorithm works on theaggregate KPI series, comparing recent KPI behavior with its historical pattern to detect unusual trending patterns over time. It doesnotevaluate behavior across separate entities within the KPI split — it simply looks at deviations from historical trends in the combined KPI values. On the other hand, theEntity Cohesionalgorithm is specifically designed to detect when entities that are expected to behave similarly begin to diverge in behavior. When a KPI is split by entity (for example, multiple servers, locations, or service tiers), Entity Cohesion normalizes each entity’s time series and compares them against each other. If one entity’s pattern differs significantly from the group’s patterns, it is flagged as an anomaly. This matches the “paired monitoring requirement” of producing an alert whenone entity in the KPI is not behaving similarly to the other entities. The option describing entity cohesion paired with that requirement reflects the correct use case for this algorithm in ITSI. Neither trending anomaly detection nor entity cohesion anomaly detection is intended to detect multiple KPIs deviating at the service level — such cross‑KPI alerts are handled by other alerting constructs like multi‑KPI alerts or correlation searches, not these specific anomaly algorithms.

 D is the correct answer because ITSI provides multiple ways to delete multiple duplicate entities. You can use a CSV upload to overwrite existing entities with new or updated information, or delete them by setting the action field to delete. You can also use the entity lister page to select multiple entities and delete them in bulk. Alternatively, you can use a search command called | deleteentity to delete entities that match certain criteria. References: Create and update entities using a CSV file in ITSI, Delete entities in bulk in ITSI, Delete entities using the | deleteentity command in ITSI

One of the recommended best practices for Splunk IT Service Intelligence (ITSI) installation is to avoid installing ITSI on search heads that already have Splunk Enterprise Security (ES) installed. This recommendation stems from potential resource conflicts and performance issues that can arise when both resource-intensive applications are deployed on the same instance. Both ITSI and ES are complex applications that require significant system resources to function effectively, and running them concurrently on the same search head can lead to degraded performance, conflicts in resource allocation, and potential stability issues. It's generally advised to segregate these applications onto separate Splunk instances to ensure optimal performance and stability for both platforms.

Define entities before creating services. When you configure a service, you can specify entity matching rules based on entity aliases that automatically add the entities to your service.