Dashboards

There are primarily two types of widgets you can employ to visualize your data:

An aggregation is a collection of data that has been grouped and organized meaningfully to provide an answer to a question you have about your data. This approach allows you to focus on the desired fields, functions, or metrics you want to know more about.

Aggregation widgets enhance this process by offering tools for organizing, visualizing, and interpreting search results from various perspectives. Aggregation widgets allow you to group data, apply metrics, and sort fields (e.g. ascending or descending) to reveal meaningful insights. For example, if you want to see which page on your website takes the longest amount of time to render, you can aggregate on the took_ms field and sort the results in descending order to determine the answer.

These widgets support features like showing the top values for quick data discovery and various visualization options to make data clearer. They are especially useful in dashboards, enabling side-by-side comparisons of multiple queries on the same page.

A message table widget displays messages and their fields. Below you see a message table widget that displays messages with their timestamp and source fields. These widgets allow for a more granular examination of individual messages. Message-level searches are crucial for investigations and any time you need detailed information.

You may also see the detailed view of a message with all its fields by clicking on a message row. All fields in a message can be added to the table as a column through the configuration menu.

You can create a new widget after running a search. As widgets are visual representations of specific sets of data, you define the data you want to see in the widget by executing a search for that specific set of data. Once you have executed the search successfully and defined any filters and parameters as needed, complete the following steps to create a new widget on the search page:

By default, creating a new widget from the search page will populate the search page with that widget. This can be helpful for temporarily visualizing your search results or if you want to keep your widget on the search page. Ultimately, widgets are most useful and can be readily shared when added to dashboards. To add your widget to a dashboard select Copy to Dashboard from the drop-down menu in the widget, and select the appropriate dashboard. For more information on dashboards, see the Dashboards documentation.

After you create a new widget, click the pen icon in the top right corner of the widget to modify its configurable properties. Depending on the type of visualization you have selected for your widget, there will be a number of settings available to you:

Metrics

Metrics are specifications or quantitative measurements that help you find answers; they help you gain more detailed insight into your data by putting it into context. A metric may give you the average amount of time spent downloading a page or a comparison of sales made in several countries.

Metrics can be determined by selecting a function and a field to aggregate on from the drop down menus in the widget configuration modal. You can use metrics to obtain a numerical result. For example, sum counts bytes for all matched messages for the given time. If you have a bar chart organized by time, it will give you an idea how much data is pushed into storage over a defined time period.

Note

For some metric field type selections you may be able to adjust the unit settings to determine what unit of measure is used in the display. For more information on adjusting unit settings, see Modify Widgets with the Value and Field Action Menus and Unit Settings.

The Percentage Metric

The percentage metric helps to display results in the form of percentages instead of raw numbers. In some cases, percentages are easier to read and provide better insight into results. Results can be represented as percentages in bar charts, pie charts, and message tables. To apply the percentage metric, for the Function field in the configuration menu, select Percentage.

To understand the application of the percentage metric, we can look at a use case. In this example an analyst wants to understand which controllers are receiving the most amount of calls and how much difference there is between each one. They could quickly reach an opinion by viewing a comparison of the percentage of calls over controllers in a chart like the one below. Here the count metric displays the number of messages received from three different message controllers.

The Percentile Metric

The percentile metric helps to display the percentile or the relative standing of a certain value compared to the total. To apply the percentage metric, for the Function field in the configuration menu, select Percentile as the function. You may then select the field you are looking for along with a percentile value from the drop down menu.

We can also look at a use case to highlight the value of the percentile metric. In this example an analyst has a web server application that reports its response times as GELF messages that are ingested by Security Data Lake. They wish to understand the application’s 90th, 95th, and 99th percentile response times. These response times could be noted as the normal range.

Visualization

A graph view can often make it easier to compare a large volume of results. For example graphs can clearly display large spikes in web traffic. Such visual displays can attract attention and help analysts to notice and respond to these events rapidly.

Security Data Lake offers a multitude of visualization types, such as area charts, bar charts, heat maps, and world maps. Choose a visualization type based on the type of data you are working with.

Note

A world map needs geographical points in the form of latitude and longitude. And if you choose to use a heat map for visualization, you need to provide the x and y values.

Value action menus and field action menus allow you to perform quick actions like removing a field from all tables or creating a new widget with all field values presented in a data table. You can also choose to highlight field values across all data tables. When you click a value or a field within a widget, you will see a drop-down menu. You can execute any displayed actions by clicking on them. See below for a full list of available field and value actions.

Unit type determines which units are offered. If you select Size as the field type, you are presented with sizing units such as byte, kilobyte and megabyte. The unit settings configuration option is available for most numeric fields and metric functions.

Each selected unit type is represented with an axis. Multiple fields with the same unit type can be displayed on the same axis. If you select to view a field with unit type size and another field with unit type time, an axis is displayed for each unit type. There are four available axes: number, size, time, and percentage.

Security Data Lake converts units for most visualization types. If you hover over a value in a widget display, you see the converted unit value. With Data Table, you can see the original field unit value when you click on the drop down arrow to the right of the converted value.

In the image below, field values are grouped by unit type. The Mode is Stack, so the two fields with the same unit type are stacked on top of each other. If you select Overlay, you see one field layered over the other.

Widgets can be duplicated or deleted by clicking the chevron in the top right corner. You can also add widgets to a list of existing dashboards or place one in a new dashboard by selecting the Copy to Dashboard check box.

Widgets can also be freely placed inside the search result grid. You can drag and drop them by clicking and holding the three lines to the left of the widget name. You can resize them by using the gray arrow in the bottom right corner. To expand a widget to full grid width, click the arrow in its top-right corner.

If you want to expand the view of aggregated data in your Log View widget, see Log View Widget.