You can view search results in the form of charts by looking at the timeline and summarization charts. These charts help you visualize the data and gain insights from it.
The following information can help you understand the timeline and summarization charts.
When you perform a search, by default a timeline chart followed by a list of log entries is displayed. This chart depicts how your search results are distributed over the time context specified. The x-axis of the chart represents the time range, which depends on the time context that you specified, while the y-axis represents the count of the search results. For example, if you performed a search for the last 7 days, you can see bars displaying the search result count for the last 7 days from today. Moving the mouse pointer on a bar displays the time and the total count of the search results.
To view the timeline chart, click the Search tab, specify an appropriate search criteria in the search bar, and click Search. For more information about performing a search, see Getting started with search.
You can change the time context of your search by using the timeline chart, as follows:
The following figure displays a summary of the search results in the form of a timeline chart, which is followed by a series of actual search results:
Timeline chart with search results (in the Table View)
The summarization chart displays a summary of your search results in the form of various kinds of charts, for example, bar diagram, pie chart, line chart, and so on. You can summarize your search results for a particular field. By default, a bar diagram is displayed for the default HOST field. Moving the mouse pointer on the chart displays the particular value (search result) along with the total count indicating the recurrence of that value. A table displaying all values along with a total count for each value is displayed next to the chart.
To view the summarization chart, proceed as follows:
By default, the legend is displayed. To hide the legend, clear the Show Legend check box.
The following figure displays the summarization chart which is available under the timeline chart:
Summarization chart (bar diagram)