Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Splunk Advanced Power User > Creating Dashboards > Flashcards

Creating Dashboards Flashcards

1
Q

What is the difference between a dashboard and a form?

A

Form is a dashboard with at least one user input

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What components do views typically include?

A

XML, HTML, CSS/JavaScript

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How is user input stored in a form?

A

Stored as a token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the root element of a dashboard and form XML?

A

< dashboard >

< form >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What XML tags surround a dashboard title?

A

< label > < /label >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What XML tags surround input sections in a Form dashboard?

A

< fieldset >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What XML tags are used to define the beginning and ending of input time?

A

< earliest > $time_tok.earliest$

< latest > $time_tok.latest$

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the options for panel visualization elements?

A

Chart, event, map, single value, table, custom viz, HTML

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the different types of panels?

A

Report, Inline, Prebuilt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which panel type has an embedded search query?

A

Inline: < search > < query > search terms… < /query >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which panel type has a search reference?

A

Report: < search ref=”Report Name” >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which panel type has a panel reference?

A

Prebuilt: < row > < panel ref=“prebuilt name” >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What troubleshooting step can you take to verify tokens are set with expected values?

A

Create html to show tokens on panel

Use showtokens.js script

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What XML tag should you wrap around special characters to ensure literal meaning?

A

< ![CDATA[ text ]] >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What should you use to add optimizations and logic to your dashboard?

A

Simple XML

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What should you use to create or modify basic dashboards?

A

Dashboard Editor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When should you use simple XML Extensions?

A

To add custom stylesheets and logic to your dashboard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

When should you get stakeholder signoff when creating dashboards?

A

After planning with stakeholders, prototyping and adding interactivity, and before improving performance and customizing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the primary transforming commands?

A

chart, timechart, stats, rare and top

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How does adding a form input change the root element of the XML?

A

Changes root element from < dashboard > to < form >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the input value of a form input?

A

User defined token

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

When can input values populate on a form?

A

Choose between page load, input change, clicking submit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Where are tokens defined in the XML?

A

After < fieldset > < input type=… token=”token_name”>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Can you use a lookup to define inputs to a dropdown input type?

A

Yes, under < input… > < search > < query > | inputlookup look_name
Improves dashboard efficiency more so than running a search

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How can tokens impact form behavior?

A

drilldowns, event handlers, conditional behavior, show/hide panels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a cascading input?

A

Use the selection of one input to reduce or set value of another input

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is used to reset a menu when another menu is changed?

A

Event handler

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What tags define what field values will populate the dropdown?

A

< fieldforlabel >

< fieldforvalue >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What is the purpose of token filters?

A

Ensure that you correctly capture a token’s value. Ex: $tok_name|s |h |u |n

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What token filter adds quotation around the returned value?

A

|s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are global environment tokens?

A

Tokens providing information about the splunk environment and users all starting with $env:attribute_name$

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What XML aspect configures appearance and behavior of dashboard and forms?

A

Element Attributes: onunloadcanceljobs script, rejects, depends, id,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How do you manage chart customization in the XML editor?

A

Through XML options:

< option name=”charting.optionname” > value < /option >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What XML option allows use of hexadecimal color values defined for each field?

A

charting.fieldColors Ex defining 2 specific fields: < option name=”charting.fieldColors” > {“ARCADE”:color1, “STRATEGY”:color2} < /option >

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What can event annotation be used for?

A

< search type=“annotation” >
Annotate a time series viz with values from another search/lookup. Display a callout, filter events for matching charts time range

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is a trellis visualization?

A

Multiple instances of a visualization driven by one query but each instance shows values for just one category

37
Q

Is Trellis layout available for tables or cluster maps?

A

no

38
Q

Can panel link buttons be adjusted to display or be hidden?

A

Yes, can be visible or hidden based on the property boolean set in the XML options:
< option name=”link.visible” >0< /option >

39
Q

Can dashboard panels be auto refreshed?

A

Only inline searches and reports

40
Q

Which tags need to be edited in the XML to adjust auto refresh?

A

< refresh > sets time between refreshes

< refreshType > point from which refresh time is counted

41
Q

What are the options for < refreshType >?

A

Delay: start counting down when search is done
Interval: start counting down when search is dispatched

42
Q

What are the 4 types of drilldowns?

A

Event, Visualization, Contextual, Dynamic

43
Q

What are the two standard event handlers?

A

Event and visualization

44
Q

What are the two custom event handlers?

A

Drilldown editor and XML Editor

45
Q

What is an event drilldown?

A

Clicking an event for a popup menu with options - only available in search results page only not in dashboards

46
Q

What is a visualization drilldown?

A

Clicking a visualization to redirect you to a search view

47
Q

What is a contextual drilldown?

A

Passing a value from user click to another panel on same dashboard/form

48
Q

What is a dynamic drillown?

A

Passing a value from a user click to another dashboard/form/external webpage

49
Q

What is the drilldown editor used for?

A

To configure dynamic or contextual drilldown actions

50
Q

What does the drilldown editor use to update token values?

A

< set > < eval > < unset >

51
Q

What are predefined tokens used for?

A

Used to capture info when a user clicks a visualization - available tokens depend on type of viz

52
Q

When should you use form.tok_name=$click.value$

A

Use as source form parameters during a dynamic drilldown. This will then be input into a destination form

53
Q

What element and tags should be used to create a multiple fields drilldown?

A

< condition field=source_field_name >

< link >

54
Q

Can you do a multiple fields drilldown in the drilldown editor?

A

No must be done in the XML

55
Q

When completing a drilldown will a token on both the drilldown and destination work?

A

No, you need a token filter (like |s) included in the destination (esp. If you are inputting the token in a search)`

56
Q

What is the purpose of an event handler?

A

Enable building of responsive dashboard by listening for interactions (mouse click/scroll) and performing defined event actions

57
Q

What are the types of event actions?

A

Eval - execute eval statement
Link - to another page
Set - set tokens
Unset - unset tokens

58
Q

How is the syntax for < set > event action defined?

A

< drilldown >
< set token=“tok” >$txt|click.something$
< /set >

59
Q

How is the syntax for < unset > event action defined?

A

< drilldown >

< unset token=“tok” >< /unset >

60
Q

How is the syntax for < eval > event action defined?

A

< eval token=“tok” >evalfunction< /eval >

61
Q

How is the syntax for < link > event action defined?

A

Dash: < link >/app/myApp/myView< /link >
Form: < link >/app/myApp/myView?form.token=$token$< /link >
URL: < link >myURL?q=$token$< /link >

62
Q

Where do event actions fall in the syntax for each event handler?

A

Form input: < change > < event action >
Search: < search > < handler: progress, done, cancelled, error, fail > < event action >
Viz: < event action >

63
Q

What are the 5 types of search event handlers?

A

progress, done, cancelled, error, fail

64
Q

What does the visualization handler < selection > enable on the dashboard?

A

Creates pan and zoom options on results

65
Q

What two predefined tokens are used with search event handlers?

A

$job.property$ and $result.field$

property = eventCount, runDuration…

66
Q

What attributes show or hide content based on existence of a token?

A

depends and rejects attributes

67
Q

Which attribute will hide content by default and show when a token exists?

A

depends attribute

68
Q

Which attribute will show content by default and hide when a token exists?

A

rejects attribute

69
Q

What is the syntax of a rejects and depends attribute?

A

< panel depends|rejects=“myPanel” >< /panel >

70
Q

What can the < change > element of form inputs be used for?

A

Used to have dash respond to user selections, enabling clearing of previously selected options that no longer apply or get in the way of new searches/panels

71
Q

What form input types can the < change > handler be used with?

A

Checkbox, dropdown, link, radio, text, time

72
Q

What visualizations can < selection > be used for?

A

Area, column, line chart

73
Q

How do you set the predefined start and end tokens for visualization < selection > handler?

A

< selection >
< set token=“selection.earliest” > $start$
< /set >
< set token=“selection.latest” > $end$
< /set >

74
Q

How do you carry out a simple XML extension?

A

Use custom CSS and JavaScript to customize a views look and behavior

75
Q

What is the syntax for referencing multiple files in the view’s XML?

A

< dashboard script=“script1.js, script2.js” AND/OR stylesheet=“sheet.css” >

76
Q

Can you reference another app’s files in a views XML?

A

Yes define within script= (or stylesheet=):

< dashboard script=“otherapp:directory /script.js” >

77
Q

Should inline searches be avoided?

A

For best performance, avoid inline searches

78
Q

Can accelerated reports use event sampling?

A

No

79
Q

Which type of acceleration automatically creates TSIDX files?

A

Data Model Accel

80
Q

What type of acceleration uses summaries to speed up completion time?

A

Accelerated reports

81
Q

Where is data stored for report acceleration?

A

Stored in Indexers

82
Q

What generating command is used to search data models (or objects) and perform stats on indexed fields in tsidx files?

A

tstats

83
Q

What does the prestats=boolean argument enable for tstats?

A

True allows you to pipe the data into charts, stats, timechart

84
Q

What does the summariesonly=boolean argument enable for tstats?

A

Applies to accelerated data models where true generates results from tsidx files (summarized data) and false pulls from summarized and non summarized

85
Q

What is a base search in XML?

A

Search, typically in dedicated search not in a panel, that provides inputs and gathers stats for post process searches in following panels: < search id=“myBaseSearch” >

86
Q

What is a post process search?

A

A search in a panel that performs additional processing based on a reference to the base search: < search base=“myBaseSearch” >

87
Q

What is a global search?

A

A single base search with post process searches that populate all panels on dash/form

88
Q

What should you do with null values in a base search?

A

Use |fillnull value=”NONE”

Remove/include in the post process search

89
Q

What is the hierarchy of XML when defining a dashboard or form?

A 
< dashboard|form >
   < row >
      < panel >
          < title >
             < chart|HTML|table|other element >

Splunk Advanced Power User (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions