Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Splunk Advanced Power User > Creating Dashboards > Flashcards

Creating Dashboards Flashcards

1
Q

What is the difference between a dashboard and a form?

A

Form is a dashboard with at least one user input

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What components do views typically include?

A

XML, HTML, CSS/JavaScript

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How is user input stored in a form?

A

Stored as a token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the root element of a dashboard and form XML?

A

< dashboard >

< form >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What XML tags surround a dashboard title?

A

< label > < /label >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What XML tags surround input sections in a Form dashboard?

A

< fieldset >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What XML tags are used to define the beginning and ending of input time?

A

< earliest > $time_tok.earliest$

< latest > $time_tok.latest$

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the options for panel visualization elements?

A

Chart, event, map, single value, table, custom viz, HTML

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the different types of panels?

A

Report, Inline, Prebuilt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which panel type has an embedded search query?

A

Inline: < search > < query > search terms… < /query >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which panel type has a search reference?

A

Report: < search ref=”Report Name” >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which panel type has a panel reference?

A

Prebuilt: < row > < panel ref=“prebuilt name” >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What troubleshooting step can you take to verify tokens are set with expected values?

A

Create html to show tokens on panel

Use showtokens.js script

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What XML tag should you wrap around special characters to ensure literal meaning?

A

< ![CDATA[ text ]] >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What should you use to add optimizations and logic to your dashboard?

A

Simple XML

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What should you use to create or modify basic dashboards?

A

Dashboard Editor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When should you use simple XML Extensions?

A

To add custom stylesheets and logic to your dashboard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When should you get stakeholder signoff when creating dashboards?

A

After planning with stakeholders, prototyping and adding interactivity, and before improving performance and customizing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the primary transforming commands?

A

chart, timechart, stats, rare and top

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How does adding a form input change the root element of the XML?

A

Changes root element from < dashboard > to < form >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the input value of a form input?

A

User defined token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

When can input values populate on a form?

A

Choose between page load, input change, clicking submit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Where are tokens defined in the XML?

A

After < fieldset > < input type=… token=”token_name”>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Can you use a lookup to define inputs to a dropdown input type?

A

Yes, under < input… > < search > < query > | inputlookup look_name
Improves dashboard efficiency more so than running a search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
How can tokens impact form behavior?
drilldowns, event handlers, conditional behavior, show/hide panels
26
What is a cascading input?
Use the selection of one input to reduce or set value of another input
27
What is used to reset a menu when another menu is changed?
Event handler
28
What tags define what field values will populate the dropdown?
< fieldforlabel > | < fieldforvalue >
29
What is the purpose of token filters?
Ensure that you correctly capture a token’s value. Ex: $tok_name|s |h |u |n
30
What token filter adds quotation around the returned value?
|s
31
What are global environment tokens?
Tokens providing information about the splunk environment and users all starting with $env:attribute_name$
32
What XML aspect configures appearance and behavior of dashboard and forms?
Element Attributes: onunloadcanceljobs script, rejects, depends, id,
33
How do you manage chart customization in the XML editor?
Through XML options: | < option name=”charting.optionname” > value < /option >
34
What XML option allows use of hexadecimal color values defined for each field?
charting.fieldColors Ex defining 2 specific fields: < option name=”charting.fieldColors” > {“ARCADE”:color1, “STRATEGY”:color2} < /option >
35
What can event annotation be used for?
< search type=“annotation” > Annotate a time series viz with values from another search/lookup. Display a callout, filter events for matching charts time range
36
What is a trellis visualization?
Multiple instances of a visualization driven by one query but each instance shows values for just one category
37
Is Trellis layout available for tables or cluster maps?
no
38
Can panel link buttons be adjusted to display or be hidden?
Yes, can be visible or hidden based on the property boolean set in the XML options: < option name=”link.visible” >0< /option >
39
Can dashboard panels be auto refreshed?
Only inline searches and reports
40
Which tags need to be edited in the XML to adjust auto refresh?
< refresh > sets time between refreshes | < refreshType > point from which refresh time is counted
41
What are the options for < refreshType >?
Delay: start counting down when search is done Interval: start counting down when search is dispatched
42
What are the 4 types of drilldowns?
Event, Visualization, Contextual, Dynamic
43
What are the two standard event handlers?
Event and visualization
44
What are the two custom event handlers?
Drilldown editor and XML Editor
45
What is an event drilldown?
Clicking an event for a popup menu with options - only available in search results page only not in dashboards
46
What is a visualization drilldown?
Clicking a visualization to redirect you to a search view
47
What is a contextual drilldown?
Passing a value from user click to another panel on same dashboard/form
48
What is a dynamic drillown?
Passing a value from a user click to another dashboard/form/external webpage
49
What is the drilldown editor used for?
To configure dynamic or contextual drilldown actions
50
What does the drilldown editor use to update token values?
< set > < eval > < unset >
51
What are predefined tokens used for?
Used to capture info when a user clicks a visualization - available tokens depend on type of viz
52
When should you use form.tok_name=$click.value$
Use as source form parameters during a dynamic drilldown. This will then be input into a destination form
53
What element and tags should be used to create a multiple fields drilldown?
< condition field=source_field_name > | < link >
54
Can you do a multiple fields drilldown in the drilldown editor?
No must be done in the XML
55
When completing a drilldown will a token on both the drilldown and destination work?
No, you need a token filter (like |s) included in the destination (esp. If you are inputting the token in a search)`
56
What is the purpose of an event handler?
Enable building of responsive dashboard by listening for interactions (mouse click/scroll) and performing defined event actions
57
What are the types of event actions?
Eval - execute eval statement Link - to another page Set - set tokens Unset - unset tokens
58
How is the syntax for < set > event action defined?
< drilldown > < set token=“tok” >$txt|click.something$ < /set >
59
How is the syntax for < unset > event action defined?
< drilldown > | < unset token=“tok” >< /unset >
60
How is the syntax for < eval > event action defined?
< eval token=“tok” >evalfunction< /eval >
61
How is the syntax for < link > event action defined?
Dash: < link >/app/myApp/myView< /link > Form: < link >/app/myApp/myView?form.token=$token$< /link > URL: < link >myURL?q=$token$< /link >
62
Where do event actions fall in the syntax for each event handler?
Form input: < change > < event action > Search: < search > < handler: progress, done, cancelled, error, fail > < event action > Viz: < event action >
63
What are the 5 types of search event handlers?
progress, done, cancelled, error, fail
64
What does the visualization handler < selection > enable on the dashboard?
Creates pan and zoom options on results
65
What two predefined tokens are used with search event handlers?
$job.property$ and $result.field$ | property = eventCount, runDuration…
66
What attributes show or hide content based on existence of a token?
depends and rejects attributes
67
Which attribute will hide content by default and show when a token exists?
depends attribute
68
Which attribute will show content by default and hide when a token exists?
rejects attribute
69
What is the syntax of a rejects and depends attribute?
< panel depends|rejects=“myPanel” >< /panel >
70
What can the < change > element of form inputs be used for?
Used to have dash respond to user selections, enabling clearing of previously selected options that no longer apply or get in the way of new searches/panels
71
What form input types can the < change > handler be used with?
Checkbox, dropdown, link, radio, text, time
72
What visualizations can < selection > be used for?
Area, column, line chart
73
How do you set the predefined start and end tokens for visualization < selection > handler?
< selection > < set token=“selection.earliest” > $start$ < /set > < set token=“selection.latest” > $end$ < /set >
74
How do you carry out a simple XML extension?
Use custom CSS and JavaScript to customize a views look and behavior
75
What is the syntax for referencing multiple files in the view’s XML?
< dashboard script=“script1.js, script2.js” AND/OR stylesheet=“sheet.css” >
76
Can you reference another app’s files in a views XML?
Yes define within script= (or stylesheet=): | < dashboard script=“otherapp:directory /script.js” >
77
Should inline searches be avoided?
For best performance, avoid inline searches
78
Can accelerated reports use event sampling?
No
79
Which type of acceleration automatically creates TSIDX files?
Data Model Accel
80
What type of acceleration uses summaries to speed up completion time?
Accelerated reports
81
Where is data stored for report acceleration?
Stored in Indexers
82
What generating command is used to search data models (or objects) and perform stats on indexed fields in tsidx files?
| tstats
83
What does the prestats=boolean argument enable for tstats?
True allows you to pipe the data into charts, stats, timechart
84
What does the summariesonly=boolean argument enable for tstats?
Applies to accelerated data models where true generates results from tsidx files (summarized data) and false pulls from summarized and non summarized
85
What is a base search in XML?
Search, typically in dedicated search not in a panel, that provides inputs and gathers stats for post process searches in following panels: < search id=“myBaseSearch” >
86
What is a post process search?
A search in a panel that performs additional processing based on a reference to the base search: < search base=“myBaseSearch” >
87
What is a global search?
A single base search with post process searches that populate all panels on dash/form
88
What should you do with null values in a base search?
Use |fillnull value=”NONE” | Remove/include in the post process search
89
What is the hierarchy of XML when defining a dashboard or form?
``` < dashboard|form > < row > < panel > < title > < chart|HTML|table|other element > ```

Splunk Advanced Power User (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions