Creating Dashboards Flashcards
What is the difference between a dashboard and a form?
Form is a dashboard with at least one user input
What components do views typically include?
XML, HTML, CSS/JavaScript
How is user input stored in a form?
Stored as a token
What is the root element of a dashboard and form XML?
< dashboard >
< form >
What XML tags surround a dashboard title?
< label > < /label >
What XML tags surround input sections in a Form dashboard?
< fieldset >
What XML tags are used to define the beginning and ending of input time?
< earliest > $time_tok.earliest$
< latest > $time_tok.latest$
What are the options for panel visualization elements?
Chart, event, map, single value, table, custom viz, HTML
What are the different types of panels?
Report, Inline, Prebuilt
Which panel type has an embedded search query?
Inline: < search > < query > search terms… < /query >
Which panel type has a search reference?
Report: < search ref=”Report Name” >
Which panel type has a panel reference?
Prebuilt: < row > < panel ref=“prebuilt name” >
What troubleshooting step can you take to verify tokens are set with expected values?
Create html to show tokens on panel
Use showtokens.js script
What XML tag should you wrap around special characters to ensure literal meaning?
< ![CDATA[ text ]] >
What should you use to add optimizations and logic to your dashboard?
Simple XML
What should you use to create or modify basic dashboards?
Dashboard Editor
When should you use simple XML Extensions?
To add custom stylesheets and logic to your dashboard
When should you get stakeholder signoff when creating dashboards?
After planning with stakeholders, prototyping and adding interactivity, and before improving performance and customizing
What are the primary transforming commands?
chart, timechart, stats, rare and top
How does adding a form input change the root element of the XML?
Changes root element from < dashboard > to < form >
What is the input value of a form input?
User defined token
When can input values populate on a form?
Choose between page load, input change, clicking submit
Where are tokens defined in the XML?
After < fieldset > < input type=… token=”token_name”>
Can you use a lookup to define inputs to a dropdown input type?
Yes, under < input… > < search > < query > | inputlookup look_name
Improves dashboard efficiency more so than running a search
How can tokens impact form behavior?
drilldowns, event handlers, conditional behavior, show/hide panels
What is a cascading input?
Use the selection of one input to reduce or set value of another input
What is used to reset a menu when another menu is changed?
Event handler
What tags define what field values will populate the dropdown?
< fieldforlabel >
< fieldforvalue >
What is the purpose of token filters?
Ensure that you correctly capture a token’s value. Ex: $tok_name|s |h |u |n
What token filter adds quotation around the returned value?
|s
What are global environment tokens?
Tokens providing information about the splunk environment and users all starting with $env:attribute_name$
What XML aspect configures appearance and behavior of dashboard and forms?
Element Attributes: onunloadcanceljobs script, rejects, depends, id,
How do you manage chart customization in the XML editor?
Through XML options:
< option name=”charting.optionname” > value < /option >
What XML option allows use of hexadecimal color values defined for each field?
charting.fieldColors Ex defining 2 specific fields: < option name=”charting.fieldColors” > {“ARCADE”:color1, “STRATEGY”:color2} < /option >
What can event annotation be used for?
< search type=“annotation” >
Annotate a time series viz with values from another search/lookup. Display a callout, filter events for matching charts time range
What is a trellis visualization?
Multiple instances of a visualization driven by one query but each instance shows values for just one category
Is Trellis layout available for tables or cluster maps?
no
Can panel link buttons be adjusted to display or be hidden?
Yes, can be visible or hidden based on the property boolean set in the XML options:
< option name=”link.visible” >0< /option >
Can dashboard panels be auto refreshed?
Only inline searches and reports
Which tags need to be edited in the XML to adjust auto refresh?
< refresh > sets time between refreshes
< refreshType > point from which refresh time is counted
What are the options for < refreshType >?
Delay: start counting down when search is done
Interval: start counting down when search is dispatched
What are the 4 types of drilldowns?
Event, Visualization, Contextual, Dynamic
What are the two standard event handlers?
Event and visualization
What are the two custom event handlers?
Drilldown editor and XML Editor
What is an event drilldown?
Clicking an event for a popup menu with options - only available in search results page only not in dashboards
What is a visualization drilldown?
Clicking a visualization to redirect you to a search view
What is a contextual drilldown?
Passing a value from user click to another panel on same dashboard/form
What is a dynamic drillown?
Passing a value from a user click to another dashboard/form/external webpage
What is the drilldown editor used for?
To configure dynamic or contextual drilldown actions
What does the drilldown editor use to update token values?
< set > < eval > < unset >
What are predefined tokens used for?
Used to capture info when a user clicks a visualization - available tokens depend on type of viz
When should you use form.tok_name=$click.value$
Use as source form parameters during a dynamic drilldown. This will then be input into a destination form
What element and tags should be used to create a multiple fields drilldown?
< condition field=source_field_name >
< link >
Can you do a multiple fields drilldown in the drilldown editor?
No must be done in the XML
When completing a drilldown will a token on both the drilldown and destination work?
No, you need a token filter (like |s) included in the destination (esp. If you are inputting the token in a search)`
What is the purpose of an event handler?
Enable building of responsive dashboard by listening for interactions (mouse click/scroll) and performing defined event actions
What are the types of event actions?
Eval - execute eval statement
Link - to another page
Set - set tokens
Unset - unset tokens
How is the syntax for < set > event action defined?
< drilldown >
< set token=“tok” >$txt|click.something$
< /set >
How is the syntax for < unset > event action defined?
< drilldown >
< unset token=“tok” >< /unset >
How is the syntax for < eval > event action defined?
< eval token=“tok” >evalfunction< /eval >
How is the syntax for < link > event action defined?
Dash: < link >/app/myApp/myView< /link >
Form: < link >/app/myApp/myView?form.token=$token$< /link >
URL: < link >myURL?q=$token$< /link >
Where do event actions fall in the syntax for each event handler?
Form input: < change > < event action >
Search: < search > < handler: progress, done, cancelled, error, fail > < event action >
Viz: < event action >
What are the 5 types of search event handlers?
progress, done, cancelled, error, fail
What does the visualization handler < selection > enable on the dashboard?
Creates pan and zoom options on results
What two predefined tokens are used with search event handlers?
$job.property$ and $result.field$
property = eventCount, runDuration…
What attributes show or hide content based on existence of a token?
depends and rejects attributes
Which attribute will hide content by default and show when a token exists?
depends attribute
Which attribute will show content by default and hide when a token exists?
rejects attribute
What is the syntax of a rejects and depends attribute?
< panel depends|rejects=“myPanel” >< /panel >
What can the < change > element of form inputs be used for?
Used to have dash respond to user selections, enabling clearing of previously selected options that no longer apply or get in the way of new searches/panels
What form input types can the < change > handler be used with?
Checkbox, dropdown, link, radio, text, time
What visualizations can < selection > be used for?
Area, column, line chart
How do you set the predefined start and end tokens for visualization < selection > handler?
< selection >
< set token=“selection.earliest” > $start$
< /set >
< set token=“selection.latest” > $end$
< /set >
How do you carry out a simple XML extension?
Use custom CSS and JavaScript to customize a views look and behavior
What is the syntax for referencing multiple files in the view’s XML?
< dashboard script=“script1.js, script2.js” AND/OR stylesheet=“sheet.css” >
Can you reference another app’s files in a views XML?
Yes define within script= (or stylesheet=):
< dashboard script=“otherapp:directory /script.js” >
Should inline searches be avoided?
For best performance, avoid inline searches
Can accelerated reports use event sampling?
No
Which type of acceleration automatically creates TSIDX files?
Data Model Accel
What type of acceleration uses summaries to speed up completion time?
Accelerated reports
Where is data stored for report acceleration?
Stored in Indexers
What generating command is used to search data models (or objects) and perform stats on indexed fields in tsidx files?
tstats
What does the prestats=boolean argument enable for tstats?
True allows you to pipe the data into charts, stats, timechart
What does the summariesonly=boolean argument enable for tstats?
Applies to accelerated data models where true generates results from tsidx files (summarized data) and false pulls from summarized and non summarized
What is a base search in XML?
Search, typically in dedicated search not in a panel, that provides inputs and gathers stats for post process searches in following panels: < search id=“myBaseSearch” >
What is a post process search?
A search in a panel that performs additional processing based on a reference to the base search: < search base=“myBaseSearch” >
What is a global search?
A single base search with post process searches that populate all panels on dash/form
What should you do with null values in a base search?
Use |fillnull value=”NONE”
Remove/include in the post process search
What is the hierarchy of XML when defining a dashboard or form?
< dashboard|form >
< row >
< panel >
< title >
< chart|HTML|table|other element >
