Managing views

This topic provides the following information for adding views and seeing a graphical display of the event data.

The following figure shows a view page with four viewlets (carrying various summarization charts) and details about the first viewlet (on the top left):

Views

Before you begin

Create a saved search using which you want to add a view. For more information, see Managing saved searches.

Adding views to display saved search results as a chart

You can add views to see a graphic representation of the saved search results for data monitoring purposes.The graphic representation is available in the form of various charts. For example, bar diagram pie chart, line chart, and so on.

Adding the saved search results (summarized as a chart) to a view page is the same as adding a viewlet to the view page. A viewlet is one of the four quadrants that appear on a page, and you can use it to display the summarization chart for a particular saved search.

You can add a viewlet summarizing the saved search results on a view page in two ways, by using the Views tab or by using the Cabinet > Saved Searches tab.

To add a viewlet from the Views tab

1. On the Views tab, perform one of the following actions:
   • Navigate to one of the existing view pages, and click one of the four quadrants where you want to summarize the search results of a saved search as a chart.
   • Add a new view page by clicking the Add new view  icon next to the Default view page, provide a view name, click Create, and then click one of the four quadrants where you want to add a saved search summarization chart.
2. Provide the following details and then click Create:
   • Viewlet Name: Provide a title for the summarization chart that you want to add in the viewlet.
   • Saved Search: Type or select the saved search for which you want to summarize search results in the form of a chart.
   • Search String: Displays the search string corresponding to the saved search selected.
   • Summarization Field: Select the field name or tag name by which you want to summarize your search results data in the viewlet.

   • Chart Type: Select one of the following chart types to summarize your search results:

     Chart type	Preview
     Bar
     Column
     Doughnut
     Line
     Pie

To add a viewlet from the Cabinet > Saved Searches tab

1. Navigate to Cabinet > Saved Searches.

2. Select the saved search that you want to add to the view, and click Add to View .

   Note

   You cannot add a saved search to a view in the following scenarios:

   • If the saved search has a custom time context because this type of saved search provides absolute results.
   • If the saved search was shared by other users and not created by you.
   • If the saved search contains a search query that uses the stats command without the group by parameter. Creating a viewlet for such a query does not provide meaningful representation of data.
     For example, in the following search query, there is no field specified to group the search results.
     * | stats count(HOST)

   However, you can use a saved search shared by another user for creating a view after cloning the saved search.

3. On the Add to View dialog box, provide the following details:
   • Summarization Field: Select the field name by which you want to summarize your search results data in the viewlet.
     This field displays a list of fields available in the Filter Pane on the Search tab and all the tags available in the system. You can add more fields to this list by adding them to the My Fields panel on the Search tab. If the saved search contains a search query that returns tabular output (for example timechart, stats commands), then the fields displayed in the list are derived from the tabular data.

   • Chart Type: Select one of the following chart types to summarize your search results:
     

     Note

     The pie and doughnut charts are not supported for saved searches that return tabular output. For example, timechart command.

   • View: Select one of the existing views (view pages) to add the search results data to that view. If you want to add the search results data to a new view, create the view by selecting Create new and providing a name for the view in the View box.
   • Viewlet Name: Provide a title for the summarization chart that you want to add in the viewlet.
   • On the Location grid, click the box in which your search results are to be displayed.
     If a viewlet is already plotted on one of the four boxes, then the viewlet name appears on that box.
   • Click Add.
     You can see the saved search details summarized in the form of a chart on the Views tab (on the specified view page).

For more information about saved searches, see Managing saved searches.

Actions available for views and viewlets

The following table lists the various actions that you can perform on views and viewlets on the Views tab:

Action	Description
Views
Add a view	Click the Add new view  icon next to the Default view page.
Reload all viewlets in a view	Navigate to a view and click Reload all viewlets at the top of the page.
Rename a view	Navigate to a view, click Rename view at the top of the page, provide the new view name, and click Update.
Delete a view	Navigate to a view, click Delete view at the top of the page, and click Yes to confirm the action.
Viewlets in an existing view
Refresh a viewlet	Navigate to a view, and on a viewlet, click Refresh Viewlet to refresh the data displayed on the summarization chart.
Edit a viewlet	Navigate to a view, on a viewlet, click Edit Viewlet to edit one or more of the following details related to that viewlet, and then click Update: Viewlet Name: The title of the viewlet. Saved Search: Select a saved search from the list. When you select a saved search, the search string related to that saved search automatically appears in the Search String box. You cannot modify this search string unless you modify the saved search. Summarization Field: Select a field by which you want to summarize the search results. Chart type: Select one of the chart type options (for example, bar diagram, pie chart) to summarize the search results. For more information, see Chart types.
Delete a viewlet	Navigate to a view, and on a viewlet, click Delete Viewlet to delete that viewlet from the current view.
Change the time context of the viewlet View the viewlet execution details	Navigate to a view, and on a viewlet, click the time range list, and then select one of the following options: Last 5 minutes Last 15 minutes Last 60 minutes Last 6 hours Last 24 hours Last 2 days Last 7 days The viewlet execution details (starting and ending date and time) are displayed next to the time range list.