Page tree
Skip to end of metadata
Go to start of metadata

Dashboards provide the capability of visualizing data in the form of various kinds of charts (such as column, line, bar, and pie charts).

The Dashboards tab allows you to add multiple charts that summarize the results of a saved search query. Saved searches are the building blocks for creating dashboards. A dashboard is made up of four equally sized quadrants called dashlets. These dashlets contain charts that summarize the results of a particular saved search query. You can add four summarization charts (dashlets) to a single dashboard. 

Dashboards can help you visualize your data at a glance and detect trends in your data. You can use dashboards in various ways, for example, you can create a separate dashboard page for each application and add dashlets containing charts which provide details about various areas of the application.

Dashboards can also be shared with other users by exporting them as a part of a content pack.

This topic provides the following information that can help you easily understand and create dashboards.

Understanding the Default dashboard page

The Default dashboard page is automatically available on the Dasboards tab, after you install the product.

This page displays the following default dashlets. These dashlets contain charts that provide valuable insights related to the product:

Dashlet nameDescription
Total data collected

Represents the data indexed by the product over the last 24 hours.

This dashlet plots a line chart which displays the sum of all the records indexed along with the total volume of data (sum of bytes) indexed in the last 24 hours. By looking at the chart, you can understand the amount of data indexed by the product and also the kind of data load handled by the product.

Example: If you see a sudden dip in the record count on a particular day, it might indicate that some data collectors or the Collection Stations (or Collection Agents) are not working.

The information represented on this dashlet can also provide an insight about the amount of data generated by the applications that you are monitoring.

In this chart, the following apply:

  • X axis represents the date and time for the last seven days.
  • Y axis on the left, represents sum of records indexed per day.
  • Y axis on the right, represents the total volume of data (sum of bytes) indexed per day.

By default, the legend is hidden. To show legend, select the Show Legend check box.

For more information, see Monitoring the product metric files.

Top 5 data collectors by volume

Provides a glimpse of the top five data collectors that are collecting the maximum volume of data compared to other data collectors present in the system.

This information can help you understand the distribution of data load across data collectors.

Total collection polls with "no data"

Provides a glimpse of the total number of polls with no data collected.

This information can help you monitor if the data collection is successful or not.

Polls with no data can occur in the following two scenarios:

  • The target files do not contain any data.
  • Data collection did not happen successfully due to some problems or failures.

You can navigate to the Administration > Data Collectors page to find out data collectors with the status showing red. For more information, see Understanding the data collection status.

You can also correlate this dashlet with the dashlet indicating the top five data collectors with no data polled.

Also, you can see the troubleshooting scenarios with respect to data collection listed at Troubleshooting common issues.

Top 5 data collectors with "no data" polls

Provides a glimpse of the top five data collectors with no data polled. These data collectors indicate data collectors with the maximum number of polls with no data.

You can correlate this dashlet with the dashlet indicating the total number of collection polls with no data collected.

This dashlet can give you insights into the problem data collectors which are no polling data successfully.

You can see the troubleshooting scenarios with respect to data collection listed at Troubleshooting common issues.

Adding dashboards and dashlets

A dashlet is one of the four quadrants that appear on a dashboard page. You can add dashlets to see a graphic representation of the saved search results for data monitoring purposes. The graphical representation is available in the form of various charts. For example, bar diagram pie chart, line chart, and so on.

By default, a dashlet provides details about search results displayed on the Search tab within one minute.

To change this time limit, you can add the indexing.psJobGetMoreTimeoutInmsec property by navigating to the searchserviceCustomConfig.properties file. This property defines the time limit (in milliseconds) after which the search (including notifications and views) times out. For more information, see Modifying the configuration files.

You can add a dashlet by using the Dashboards tab or by using the Saved Searches tab.

The following instructions describe the procedure for adding a dashboard and dashlets and the various actions available while adding or editing dashlets.

Adding a dashboard

You can add a dashboard from the Dashboads page. Alternatively, you can also add a dashboard from the Saved Searches tab. For more information, see Adding a dashlet from the Saved Searches tab.

  1. Navigate to the Dashboards page.
  2. Click the Add new dashboard icon next to the Default dashboard page.
  3. Provide dashboard name and click Create.

Adding a dashlet from the Dashboards tab

You can add a dashlet by navigating to an existing dashboard page or by adding a new dashboard page first.

  1. Navigate to the appropriate dashboard page, under the Dashboards tab, and click one of the four quadrants on the page.
  2. Provide the following details and then click Create:
    • Dashlet Name: Provide a title for the chart that you want to add in the dashlet.
    • Saved Search: Type or select the saved search for which you want to summarize search results in the form of a chart.

      Tip

      While typing the saved search name, you can specify any portion of the saved search name. You can even specify the content pack name via which the saved search was imported. Saved searches imported via a content pack are suffixed with the content pack name; the content pack name is displayed in square brackets.

      Also, consider reading the notes about using a saved search in a dashlet.

    • Search String: Displays the search string corresponding to the saved search selected.
    • Summarization Field: Select the field name or tag name by which you want to summarize your search results data in the dashlet.
    • Chart Type: Select one of the following chart types to summarize your search results:

      Chart typePreview
      Bar

      Column
      Doughnut
      Line
      Pie

Adding a dashlet from the Saved Searches tab

  1. Navigate to the Saved Searches tab.
  2. Select the saved search that you want to add to the dashboard page, and click Add to Dashboard .

    Note

    You cannot add a saved search to a dashboard in the following scenarios:

    • If the saved search has a custom time context because this type of saved search provides absolute results.
    • If the saved search contains a search query that uses the stats search command command without the group by parameter. Creating a dashlet for such a query does not provide meaningful representation of data.
      For example, in the following search query, there is no field specified to group the search results.
      * | stats count(HOST)
  3. On the Add to Dashboard dialog box, provide the following details:
    • Summarization Field: Select the field name by which you want to summarize your search results data in the dashlet.
      You can select from a list of fields which are available on the Filters panel on the Search tab and all the tags which are available in the system. You can add more fields to this list by adding more fields to the Fields section, on the Filters panel. If the saved search contains a search query that returns tabular output (for example timechart search command, stats search command commands), then the fields displayed in the list are derived from the tabular data.
    • Chart Type: Select one of the following chart types to summarize your search results:

      Chart typePreview
      Bar

      Column
      Doughnut
      Line
      Pie

      Note

      The pie and doughnut charts are not supported for saved searches that return tabular output. For example, timechart search command command.

    • Dashboard: Select one of the existing dashboard pages to add the search results data to that dashboard page. If you want to add the search results data to a new dashboard page, then create the new dashboard page by selecting Create new and provide a name for the dashboard in the Dashboard box.
    • Dashlet Name: Provide a title for the summarization chart that you want to add in the dashlet.
    • On the Location grid, click the box in which your search results are to be displayed.s
      If a dashlet is already plotted on one of the four boxes, then the dashlet name appears on that box.
    • Click Add.
      You can see the saved search details summarized in the form of a chart on the Dashboards tab (on the specified dashboard page).

For more information about saved searches, see Saving and sharing searches for analytics and monitoring    .

Actions available for dashboards and dashlets

The following table lists the various actions that you can perform on dashboards and dashlets available under the Dashboards tab:

ActionDescription
Dashboards
Add a dashboardClick the Add new dashboard icon at the top of the page, provide the new dashboard name, and click Create.
Reload all dashlets in a dashboardNavigate to a dashboard page and click Reload all Dashlets at the top of the page.
Rename a dashboard

Navigate to a dashboard page, click Rename Dashboard at the top of the page, provide the new dashboard name, and click Update.

Note: If you rename the Default dashboard page, then while setting the product landing page on the Settings > User Settings page, the new name is populated.

Delete a dashboard

Navigate to a dashboard page, click Delete Dashboard at the top of the page, and click Yes to confirm the action.

Note: If you delete the Default dashboard page, then even if the product landing page was set to the Default dashboard page, the Search page is set as the new landing page.

Clone a dashboardNavigate to a dashboard page, click Clone Dashboard at the top of the page, provide the new dashboard name, and click Create.
Dashlets in an existing dashboard
Reload a dashletNavigate to a dashboard page, and on a dashlet, click Reload Dashlet to refresh the data displayed on the summarization chart.
View details of a dashletNavigate to a dashboard page, and on a dashlet, click View Dashlet to view details of the dashlet. Details include the dashlet name, saved search name, search string, summarization field, and chart type selected.  If the search string is too long, you can point on it to see the entire string as a tool-tip.
Edit a dashlet

Navigate to a dashboard page, on a dashlet, click Edit Dashlet to edit one or more of the following details related to that dashlet, and then click Update:

  • Dashlet Name: The title of the dashlet.
  • Saved Search: Select a saved search from the list. When you select a saved search, the search string related to that saved search automatically appears in the Search String box. The search string is not editable.
  • Summarization Field: Select a field by which you want to summarize the search results.
  • Chart type: Select one of the chart type options (for example, bar diagram, pie chart) to summarize the search results. For more information, see Chart types.

Note: You cannot modify a dashlet in a dashboard that was imported via a content pack.

Delete a dashletNavigate to a dashboard page, and on a dashlet, click Delete Dashlet to delete that dashlet from the current dashboard page.
  • Change the time context of the dashlet
  • View the dashlet execution details

Navigate to a dashboard page, and on a dashlet, click the time range list, and then select one of the following options:

  • Last 5 minutes
  • Last 15 minutes
  • Last 60 minutes
  • Last 6 hours
  • Last 24 hours
  • Last 2 days
  • Last 7 days

The dashlet execution details (starting and ending date and time) are displayed next to the time range list.

Show or clear legends

By default, dashlets based on a tabular command search query, provide legends next to the graph.

By default, the legend is hidden. To show legend, select the Show Legend check box.

Run a searchNavigate to a dashboard page, and on a dashlet, click one of the portions of the chart to run the saved search query associated with the dashlet.

Setting custom dashboard pages as the product landing page

By default the Default dashboard page is set as the landing page when you log on to the product. You can change the landing page to show another existing dashboard page.

To do this, navigate to Settings > User Settings, and select the correct option available in the Landing Page list.

Notes about using a saved search in a dashlet

The following notes are important to keep in mind while selecting a saved search to add a dashlet:

  • Saved searches imported via a content pack are subject to changes with a content pack update. If you want to avoid any future changes made to the saved search (that is used in the dashboard), you can first clone the saved search by navigating to the Saved Searches tab and then create the dashboard based on the cloned copy. For more information about the changes that can occur with a content pack update, see Creating and managing content packs.
  • If your saved search string includes a search command that provides tabular outputs (for example, the timechart search command command), the option to represent the search results in the form of a chart is unavailable. For more information about tabular commands, see Search commands.
  • The saved search forms the basis of a dashlet. Deletion of a saved search can result in deletion of the dependent dashlet.
  • If you add a dashlet based on a public saved search and if that saved search is deleted, a private copy of the saved search is automatically created so that objects configured based on the deleted saved search continue to function. The private copy details are automatically updated in the dashlet and listed on the Saved Searches page. Also, the user who created the dashlet becomes the owner of the private copy. A public saved search can have the following sources. The private copy name differs based on the type of source.
    • Imported via a content pack: Based on this source, the private copy is named as "Copy of <SavedSearchName> from <ContentPackName>".
    • Created by another user: Based on this source, the private copy is named as "Copy of <SavedSearchName>".
    Note that if the owner of a public saved search turned the saved search into a private one (by clearing the Make Public check box), then a private copy of that saved search is created. The users using the original public saved search in the dashlet become owners of the private copy. The private copy details are automatically updated in the dashlets using the saved search.