Discuss Splunk SPLK-4001 Exam Topic 9 Question 10

A user wants to add a link to an existing dashboard from an alert. When they click the dimension value in the alert message, they are taken to the dashboard keeping the context. How can this be accomplished? (select all that apply)

ABuild a global data link.

BAdd a link to the Runbook URL.

CAdd a link to the field.

DAdd the link to the alert message body.

Suggested Answer: A, C

The possible ways to add a link to an existing dashboard from an alert are:

Build a global data link. A global data link is a feature that allows you to create a link from any dimension value in any chart or table to a dashboard of your choice. You can specify the source and target dashboards, the dimension name and value, and the query parameters to pass along. When you click on the dimension value in the alert message, you will be taken to the dashboard with the context preserved1

Add a link to the field. A field link is a feature that allows you to create a link from any field value in any search result or alert message to a dashboard of your choice. You can specify the field name and value, the dashboard name and ID, and the query parameters to pass along. When you click on the field value in the alert message, you will be taken to the dashboard with the context preserved2

Therefore, the correct answer is A and C.

To learn more about how to use global data links and field links in Splunk Observability Cloud, you can refer to these documentations12.

1: https://docs.splunk.com/Observability/gdi/metrics/charts.html#Global-data-links 2: https://docs.splunk.com/Observability/gdi/metrics/search.html#Field-links

Get Premium SPLK-4001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

16 comments · newest first

Maynard 11 months ago

Adding a link to the field sounds too simple, is it really that easy?

Keva 11 months ago

I disagree, the Runbook URL won't work for this.

Scot 11 months ago

Wait, can you really keep the context with just a field link?

Lelia 11 months ago

I think adding a link to the alert message body is the way to go.

Paz 11 months ago

You can definitely build a global data link!

Jettie 12 months ago

I believe adding a link to the field is a possibility, but I can't recall if it maintains the context when clicked.

Izetta 12 months ago

I’m a bit confused about the Runbook URL option. Does that really link to the dashboard context?

Nobuko 12 months ago

I remember practicing a similar question, and I feel like adding a link to the alert message body could work too.

Krissy 1 year ago

I think building a global data link might be the right approach, but I'm not entirely sure how it keeps the context.

Howard 1 year ago

I'm leaning towards Option B, adding a link to the Runbook URL. That could give us a way to capture the alert context and pass it to the dashboard. But I'm not 100% sure if that's the most efficient solution.

Lashawn 1 year ago

Okay, I've got an idea. Adding the link to the alert message body (Option D) could work, as long as the link is configured to pass the relevant context parameters. That might be the best approach here.

Evette 1 year ago

I think the key here is to keep the context from the alert when navigating to the dashboard. Option C, adding a link to the field, seems like the most straightforward way to accomplish that.

Mirta 1 year ago

Hmm, I'm not sure about this one. Building a global data link (Option A) could work, but I'm not confident that would maintain the context from the alert. I'll have to think this through a bit more.

Hana 1 year ago

Hmm, I'm a little unsure about this one. I know enterprise architecture covers different aspects of an organization, but I can't quite remember the specific domains. I'll have to think this through carefully.

Winfred 1 year ago

I'm pretty confident the answer is 4 phases. I remember learning about the different stages the data goes through during the indexing process in Splunk. I'll mark that as my final answer.

Theodora 1 year ago

Okay, I think I've got this. Implementing right-sizing to match the resources to the job requirements is probably the best solution here. That should help optimize the cost and performance without over-provisioning.

Splunk SPLK-4001 Exam - Topic 9 Question 10 Discussion