Using the Timeline and Summarization charts

This topic provides information about the Timeline Chart and the Summarization Chart.

Viewing theTimeline Chart

When you perform a search, by default a Timeline Chart followed by a list of log entries is displayed. This chart depicts how your search results are distributed over the time context specified. The x-axis of the chart represents the time range, which depends on the time context that you specified, while the y-axis represents the count of the search results. For example, if you performed a search for the last 7 days, you can see bars displaying the search result count for the last 7 days from today. Moving the mouse pointer on a bar displays the time and the total count of the search results. You can click one of the bars in the chart to drill down into your search results. For example, if your search results are summarized on a monthly basis, click one of the bars to drill down into the results on a weekly basis, and then further click one of the bars to drill down into the results on a daily basis, and so on.

To view the Timeline Chart, click the Search tab, specify an appropriate search criteria in the search bar, and click Search. For more information about performing a search, see Performing a search and viewing results.

The following figure displays the Timeline Chart with the Filter Pane and the Workspaces panel collapsed:

Timeline Chart with search results

Viewing the Summarization Chart

The Summarization Chart displays a summary of your search results in the form of a bar diagram or a pie chart. You can summarize your search results for a particular field. By default, a bar diagram is displayed for the default HOST field. Moving the mouse pointer on the chart displays the particular value (search result) along with the total count indicating the recurrence of that value. A table displaying all values along with a total count for each value is displayed next to the chart. 

To view the Summarization Chart, proceed as follows:

1. Perform a search on the Search tab. For more information, see Searching the data.
2. Under the Timeline Chart, click the Chart View .
3. Select a field from the Summarization field list.
4. Select Bar or Pie from the Chart type list.
5. Click Apply.

The following figure displays the Summarization Chart with the Filter Pane and the Workspaces panel collapsed:

Summarization Chart (bar diagram)