SPLK-3002 Leak Questions

 D is the correct answer because ITSI provides multiple ways to delete multiple duplicate entities. You can use a CSV upload to overwrite existing entities with new or updated information, or delete them by setting the action field to delete. You can also use the entity lister page to select multiple entities and delete them in bulk. Alternatively, you can use a search command called | deleteentity to delete entities that match certain criteria. References: Create and update entities using a CSV file in ITSI, Delete entities in bulk in ITSI, Delete entities using the | deleteentity command in ITSI

In Splunk IT Service Intelligence (ITSI), when a Key Performance Indicator (KPI) aggregate value is calculated, thetstatsfunction is often called. Thetstatsfunction in Splunk is used for rapid statistical queries over large volumes of data, which is particularly useful in ITSI for efficiently calculating aggregate values of KPIs across potentially vast datasets. This function allows for quick aggregation and summarization of indexed data, which is essential for monitoring and analyzing the performance metrics that KPIs represent in ITSI. Unlike thestatscommand, which operates on already retrieved events,tstatsworks directly on indexed data, providing faster performance especially when dealing with high volumes of data typical in an IT environment. Thetstatscommand is therefore fundamental in the backend processing of ITSI for calculating aggregate values of KPIs, enabling real-time and historical analysis of service health and performance.

When creating a custom deep dive, services or KPIs that are in maintenance mode are shown in gray color in the topology view. This indicates that they are not actively monitored and do not generate alerts or notable events. References: Deep Dives

By default, notable event metadata is archived after six months to keep the KV store from growing too large.