6.4 Investigation Workflows and Exam Tips

Tying Visualization Skills Together

The Fundamentals exam does not test visualization features in isolation. Questions often describe a scenario — an alert fires, a dashboard looks wrong, a host disappears — and expect you to choose the right tool and setting. This section walks through the investigation workflow Datadog practitioners use daily and the exam traps that appear across Host Map, dashboards, and monitors.

The Standard Investigation Workflow

A reliable on-call sequence looks like this:

1. Alert or symptom — a monitor notification, user report, or anomaly on a dashboard.
2. Scope with infrastructure views — open Host Map or Infrastructure List, apply tag filters (env:prod, service:checkout), Group by the dimension you suspect (availability zone, role, cluster).
3. Identify hotspots — use Fill by and Size by to find which entities are unhealthy.
4. Drill into detail — click a tile for the host side panel, or open Metrics Explorer with the same tag scope.
5. Correlate on a dashboard — pivot to a service dashboard that combines CPU, latency, error rate, and queue depth.
6. Confirm or create a monitor — if this gap was not caught automatically, add or tune a monitor with appropriate grouping and no-data handling.

Each step uses a different Datadog surface, but tags are the constant. The same env:prod AND service:checkout filter works in Host Map, Metrics Explorer, dashboards (via template variables or hard-coded scope), and monitor queries. Candidates who treat tags as a first-class concept — not an afterthought — score better across the entire exam, not just this domain.

Scenario Walkthrough: Disk Space Alert

Scenario: A metric monitor grouped by {host,device} alerts that system.disk.in_use exceeded 90% on prod-db-03:/var.

Step 1 — Read the notification. Grouping tells you exactly which host and mount point failed. No fleet-wide guessing needed.

Step 2 — Host Map. Filter host:prod-db-03, Fill by disk utilization. Confirm whether this is an isolated disk or part of a broader storage trend on the host.

Step 3 — Metrics Explorer. Query avg:system.disk.in_use{host:prod-db-03} by {device} over 7 days. Is usage climbing steadily (capacity planning) or spiked suddenly (runaway logs or temp files)?

Step 4 — Dashboard. Open the database team dashboard scoped to $env=prod. Compare disk, I/O, and query latency widgets — disk pressure often correlates with slow queries or replication lag.

Step 5 — Prevent recurrence. Tune the existing monitor's warning threshold for earlier notice, or add no-data handling if disk metrics should always report.

This walkthrough hits metric monitors, grouping, Host Map, Metrics Explorer, dashboards, and no-data concepts in one realistic flow — exactly how Fundamentals scenarios are written.

Cross-Tool Comparison Table

Exam Strategy for the Visualization Domain

Read what the control modifies. Host Map Group by rearranges display; it does not delete hosts or mutate tags. Template variables change query scope; they do not rename metrics. Monitor tags organize monitors; they are not query filters.

Know the defaults. Host Map Fill by = CPU. Metrics Explorer picker = metrics active in last 24 hours. Timeseries newest point = partial data shading when the bucket is incomplete.

Separate "visualization" from "configuration." Wrong answers often assign configuration tasks to visualization tools: compiling integrations, rotating API keys, editing YAML, installing the Agent. If the tool is Host Map, a dashboard widget, or Metrics Explorer, it reads data — it does not change Agent behavior.

Global vs local changes. Changing a metric's type on the Metrics Summary page (gauge to count, for example) affects that metric everywhere — all dashboards, monitors, and queries. The exam explicitly tests this global impact.

Aggregation direction matters. Space aggregation (across hosts at one timestamp) and time aggregation (within one bucket over time) are different. A question about "combining values from multiple reporting sources at each time point" is space aggregation. A question about "incomplete latest bucket" is time visualization.

Mixed-Domain Connections

Visualization questions often assume knowledge from earlier domains:

• Tags from Data Collection appear in every from box and group-by.
• Agent health (datadog.agent.up, Agent version in Infrastructure List) connects to Troubleshooting.
• Metric types (gauge, count, rate) from Data Collection affect how graphs and monitors interpret values.
• Service checks bridge integrations (Data Collection) and host monitors (Visualization).

When studying, trace each visualization feature back to the data that feeds it. A Host Map with no tiles usually means a scope or Agent problem — not a Host Map bug.

Final Review Checklist

Before exam day, confirm you can explain:

• Host Map Fill by, Size by, and Group by — defaults and purpose
• Infrastructure List as Host Map's tabular sibling
• Timeseries vs Query Value vs Top List widget roles
• Template variables and Quick Graphs use cases
• Metric monitor vs host monitor selection
• Group by for multi-alert evaluation
• Monitor tags vs metric tags
• No-data notification purpose
• Partial data shading meaning
• Global impact of metric type changes

If you can walk through the disk-space scenario above without hesitation, you are ready for the Visualization & Utilization questions on the Fundamentals exam.