This topic provides the following information for adding views and seeing a graphical display of the event data.
The Views tab allows you to add multiple summarization charts related to multiple search queries in one page. This tab helps you to view various trends in your event data at a glance. You can use views in various ways. For example, you can create a separate view page for each application and then add summarization charts on that page.
A view is made up of four equally sized quadrants called viewlets. These viewlets contain charts that summarize the results of a particular saved search query. You can add four summarization charts (viewlets) at the same time to a single view. The Default view page is available by default on the Views tab. You can add more view pages to the Views tab by clicking Add new viewnext to the Default view page, or you can add them when you are adding a saved search to the view. You can edit and delete view pages and reload viewlets on the view pages, but you cannot delete the Default view page. You can also edit, delete, and reload individual viewlets that have been added to a particular view page.
The following figure shows a view page with four viewlets (carrying various summarization charts) and details about the first viewlet (on the top left):
Create a saved search using which you want to add a view. For more information, see Managing saved searches.
You can add views to see a graphic representation of the saved search results for data monitoring purposes.The graphic representation is available in the form of a bar diagram and a pie chart.
If your saved search string includes a search command that provides tabular outputs (for example, the timechart command), the option to represent the search results as a pie chart is unavailable.
Adding the saved search results (summarized as a chart) to a view page is the same as adding a viewlet to the view page. A viewlet is one of the four quadrants that appear on a page, and you can use it to display the summarization chart for a particular saved search.
You can add a viewlet summarizing the saved search results on a view page in two ways, by using the Views tab or by using the Cabinet > Saved Searches tab.
By default, a viewlet provides details about search results displayed on the Search tab within one minute.
To change this time limit, you can add the
indexing.psJobGetMoreTimeoutInmsec property by navigating to the searchserviceCustomConfig.properties file. This property defines the time limit (in milliseconds) after which the search (including notifications and views) times out. For more information, see Modifying the configuration files.
Select the saved search that you want to add to the view, and click Add to View.
You cannot add a saved search to a view in the following scenarios:
byparameter. Creating a viewlet for such a query does not provide meaningful representation of data.
* | stats count(HOST)
For more information about saved searches, see Managing saved searches.
The following table lists the various operations that you can perform on views and viewlets on the Views tab:
|Add a view||Click the Add new viewicon next to the Default view page.|
|Reload all viewlets in a view||Navigate to a view and click Reload all viewlets at the top of the page.|
|Rename a view|
Navigate to a view, click Rename view at the top of the page, provide the new view name, and click Update.
|Delete a view||Navigate to a view, click Delete view at the top of the page, and click Yes to confirm the action.|
|Viewlets in an existing view|
|Refresh a viewlet||Navigate to a view, and on a viewlet, click Refresh Viewletto refresh the data displayed on the summarization chart.|
|Edit a viewlet|
Navigate to a view, on a viewlet, click Edit Viewletto edit one or more of the following details related to that viewlet, and then click Update:
|Delete a viewlet||Navigate to a view, and on a viewlet, click Delete Viewletto delete that viewlet from the current view.|
Navigate to a view, and on a viewlet, click the time range list, and then select one of the following options:
The viewlet execution details (starting and ending date and time) are displayed next to the time range list.