SPLK-3002 Exam Dumps : Splunk IT Service Intelligence Certified Admin Exam

Splunk ITSI offers two built‑in anomaly detection algorithms:TrendingandEntity Cohesion. TheTrendingalgorithm works on theaggregate KPI series, comparing recent KPI behavior with its historical pattern to detect unusual trending patterns over time. It doesnotevaluate behavior across separate entities within the KPI split — it simply looks at deviations from historical trends in the combined KPI values. On the other hand, theEntity Cohesionalgorithm is specifically designed to detect when entities that are expected to behave similarly begin to diverge in behavior. When a KPI is split by entity (for example, multiple servers, locations, or service tiers), Entity Cohesion normalizes each entity’s time series and compares them against each other. If one entity’s pattern differs significantly from the group’s patterns, it is flagged as an anomaly. This matches the “paired monitoring requirement” of producing an alert whenone entity in the KPI is not behaving similarly to the other entities. The option describing entity cohesion paired with that requirement reflects the correct use case for this algorithm in ITSI. Neither trending anomaly detection nor entity cohesion anomaly detection is intended to detect multiple KPIs deviating at the service level — such cross‑KPI alerts are handled by other alerting constructs like multi‑KPI alerts or correlation searches, not these specific anomaly algorithms.

Copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on all individual indexers in your environment.

ITSI provides a kvstore_to_json.py script that lets you backup/restore ITSI configuration data, perform bulk service KPI operations, apply time zone offsets for ITSI objects, and regenerate KPI search schedules.

When you run a backup job, ITSI saves your data to a set of JSON files compressed into a single ZIP file.