XDR-ENGINEER · Question #37
An engineer is building a dashboard to visualize the number of alerts from various sources. One of the widgets from the dashboard is shown in the image below: The engineer wants to configure a…
The correct answer is B. $x_axis.value. In a typical alerts dashboard widget, alert names are plotted along the x-axis (categories), while the y-axis represents the count or metric. When a user clicks on a specific alert name, $x_axis.value captures the actual string value of the selected bar/category - in this case…
Question
An engineer is building a dashboard to visualize the number of alerts from various sources. One of the widgets from the dashboard is shown in the image below:
The engineer wants to configure a drilldown on this widget to allow dashboard users to select any of the alert names and view those alerts with additional relevant details. The engineer has configured the following XQL query to meet the requirement:
dataset = alerts | fields alert_name, description, alert_source, severity, original_tags, alert_id, incident_id | filter alert_name = | sort desc _time How will the engineer complete the third line of the query (filter alert_name =) to allow dynamic filtering on a selected alert name?
Exhibit
Options
- A$y_axis.value
- B$x_axis.value
- C$x_axis.name
- D$y_axis.name
How the community answered
(23 responses)- A13% (3)
- B57% (13)
- C26% (6)
- D4% (1)
Explanation
In a typical alerts dashboard widget, alert names are plotted along the x-axis (categories), while the y-axis represents the count or metric. When a user clicks on a specific alert name, $x_axis.value captures the actual string value of the selected bar/category - in this case, the alert name itself - enabling the filter alert_name = $x_axis.value to dynamically retrieve only matching alerts.
Why the distractors are wrong:
- A.
$y_axis.value- The y-axis holds numeric data (e.g., alert count). This would inject a number, not an alert name string, into the filter. - C.
$x_axis.name-.namereturns the field label of the x-axis (the string "alert_name"), not the selected data value. You'd effectively be filteringalert_name = "alert_name", which is meaningless. - D.
$y_axis.name- Same.nameproblem, but for the y-axis field label (e.g., "count") - doubly wrong axis and wrong property.
Memory tip: Think "axis = where it lives, value = what you clicked." Alert names live on the x-axis, and you want the value of the clicked item → $x_axis.value. If you ever see .name, it's the column header, not the data.
Topics
Community Discussion
No community discussion yet for this question.