Understand the certification
SPLK-3002 Splunk IT Service Intelligence Certified Admin 是 Splunk ITSI 产品的管理员认证，60 题 / 75 分钟。前置要求：Splunk Core Certified Admin（SPLK-1003）。
ITSI（IT Service Intelligence）是 Splunk 的 AIOps 解决方案，核心功能是服务健康评分（通过 KPI 聚合计算每个 IT 服务的实时健康状态）和事件聚合（Episode Review，用机器学习把海量告警聚合成有意义的事件组）。
考试核心是 Service 和 KPI 配置（约 25%）、Episode Review 和 Notable Events（约 20%）、Glass Table 可视化（约 15%）、Predictive Analytics（异常检测 + 预测性告警，约 15%）。和 Splunk Core 认证的区别：Core 考 SPL 和平台管理，ITSI 考的是 IT 运维场景下的服务监控和 AIOps 配置。
Exam at a glance
- Exam code
- SPLK-3002
- Provider
- 其他
- Format
- single-choice / multiple-choice
- Language
- English
- Validity
- 3 years
Skills in focus
Learning outcomes
- 掌握 Splunk ITSI 平台的完整服务建模和 KPI 管理能力
- 能够设计和优化 Episode Review 工作流与告警降噪策略
- 熟练配置深度搜索面板和玻璃表进行服务健康可视化
- 自信通过 Splunk IT Service Intelligence Certified Admin（SPLK-3002）认证考试
Who this is for
- 负责 Splunk ITSI 平台部署、配置和管理的 IT 运维管理员
- 在 NOC（网络运营中心）使用 ITSI 进行服务健康监控的运维工程师
- 已持有 Splunk Core Certified Power User 并向 IT 运维监控方向发展的 Splunk 专业人员
- 希望获得 AIOps 平台管理认证的 IT 运维专业人员
Before you start
- 建议持有 Splunk Core Certified User（SPLK-1001）或 Power User（SPLK-1002）认证
- 具备 IT 运维监控基础知识：IT 服务管理（ITSM）、KPI 概念、告警管理流程
- 熟悉 Splunk SPL 搜索语言和数据模型基础概念
- 了解基本网络和系统运维知识（服务器、网络设备、应用监控）
Your learning path
3 chapters
Plan your preparation
- Learning hours
- 10h
- With relevant experience
- 4-6 weeks
- Starting from scratch
- 8-12 weeks
- Daily study
- 1-2h
Included in your preparation
- 123 道练习题覆盖全部 SPLK-3002 考试域
- 重点考查服务 KPI 配置和 Episode Review 管理的实战场景题
- 涵盖 ITSI 告警降噪和服务健康评分配置的高频考点
- AI 辅导功能帮助精准定位 ITSI 管理薄弱环节
- 每道题含详细解析，深入理解 AIOps 平台管理原理
1. 第一阶段：ITSI 架构和 Service/KPI（2 周）
理解 ITSI 的 Service Tree 层级模型。练习创建 Service、定义 KPI（Base Search + Threshold）、配置 Health Score 权重。KPI Baseline 的训练和阈值自动调整机制。
2. 第二阶段：Episode Review + Glass Table（2 周）
Episode 的聚合规则配置（Split-by Field、Breaking Criteria）。Notable Event 的严重级别和 Correlation Search。Glass Table 的拖拽式可视化配置。
3. 第三阶段：Predictive Analytics + 模考（1-2 周）
Anomaly Detection（Adaptive Thresholding vs Static Thresholding）。Predictive Analytics 的模型训练和告警配置。做 2 套模考。
Career value
ITSI 是 Splunk 针对大型 IT 运维团队的高端产品，客单价高但部署量远小于 Splunk Core。持证者主要分布在金融、电信、大型企业的 IT 运维部门。
适合考的人：正在管理或部署 Splunk ITSI 环境的管理员。
不适合考的人：只用 Splunk Core 做日志分析或安全检测的人 — ITSI 是完全独立的产品模块。
- 澳洲
- AUD 130,000 – 170,000
- 美国
- USD 115,000 – 160,000
- 新加坡
- SGD 90,000 – 140,000
Preparation tips
Common mistakes
- **KPI Base Search 和 Service Search 混淆** — Base Search 是 KPI 的数据源查询，Service Search 是跨 KPI 的聚合。配置层级要搞清楚。
- **Episode 聚合规则设太松或太紧** — 太松导致不相关的告警混在一起，太紧导致聚合效果差。考试会给场景问最佳配置。
- **没在 ITSI 环境实操** — 没有 ITSI 实际操作经验很难理解 Glass Table 和 Predictive Analytics 的配置界面。Splunk 有 ITSI 试用版可以练习。
Before you register
How difficult is the Splunk SPLK-3002 Cloud Certified Admin exam?
The SPLK-3002 exam is 90 minutes long with approximately 53 single-choice and multiple-choice questions, requiring a 70% passing score. It focuses on Splunk Cloud platform management and configuration, including data input management, user permission configuration, Splunk Cloud-specific features and limitations. Understanding the key differences between Splunk Cloud and Splunk Enterprise is essential.
What core knowledge domains does the SPLK-3002 exam cover?
The exam primarily tests Splunk Cloud architecture and deployment models, data input and forwarder configuration, knowledge object management (field extractions, lookups, data models), user role and permission management, Splunk Cloud Admin Config Service operations, and Splunk Cloud security and compliance configuration.
What are the main differences between Splunk Cloud and Splunk Enterprise?
Splunk Cloud is a Splunk-hosted SaaS service where users do not need to manage underlying infrastructure. Key differences include: indexers and search heads are managed by Splunk, certain management functions are performed via the Splunk Cloud Admin Config Service, some Enterprise features are restricted or unavailable in Cloud, and data ingestion uses HTTP Event Collector or forwarders.
What is the difference between SPLK-3002 and SPLK-3001?
SPLK-3002 focuses on Splunk Cloud platform management, testing administration and configuration skills in a SaaS environment. SPLK-3001 is the Enterprise Certified Consultant, focusing on on-premises enterprise-level architecture design. They target different deployment models, and SPLK-3002 is more suitable for administrators managing Splunk Cloud environments.
Does the exam cover Splunk Cloud Admin Config Service operations?
Yes, the Splunk Cloud Admin Config Service (ACS) is a key exam topic. You need to understand how to manage data inputs, configure IP allow lists, manage tokens, create indexes through the admin console, and know which operations require submitting a Splunk support ticket.
How can I effectively prepare for the Splunk SPLK-3002 exam?
Focus on studying Splunk Cloud architecture and Admin Config Service operations, understanding Cloud-specific limitations and best practices. Use our platform's 123 practice questions for targeted training, paying special attention to data input configuration, permission management, and Cloud-specific features. If you have access to a Splunk Cloud trial environment, hands-on practice is highly recommended.
Learner experiences
Loading reviews…
Service 和 KPI 配置是考试的绝对重点 — 给你一个业务服务的 SLA 要求，问怎么配 KPI 和 Health Score。Episode Review 的聚合逻辑也很重要，必须理解 Split-by 和 Breaking Criteria 的实际效果。
R. Mehta
ITSI 管理员 @ 银行 IT 运维 · 通过 · 5 weeks
Start with the first chapter.
2 free chapters · Full preparation from $39