Creating and managing dashboards

Dashboards provide the capability of visualizing data in the form of various kinds of charts (such as column, line, bar, and pie charts).

The Dashboards tab allows you to add multiple charts that summarize the results of a saved search query. Saved searches are the building blocks for creating dashboards. A dashboard is made up of four equally sized quadrants called dashlets. These dashlets contain charts that summarize the results of a particular saved search query. You can add four summarization charts (dashlets) to a single dashboard.

Dashboards can help you visualize your data at a glance and detect trends in your data. You can use dashboards in various ways, for example, you can create a separate dashboard page for each application and add dashlets containing charts which provide details about various areas of the application.

Dashboards can also be shared with other users by exporting them as a part of a content pack.

This topic provides the following information that can help you easily understand and create dashboards.

Understanding the Default dashboard page

The Default dashboard page is automatically available on the Dasboards tab, after you install the product.

This page displays the following default dashlets. These dashlets contain charts that provide valuable insights related to the product:

Dashlet name	Description
Total data collected	Represents the data indexed by the product over the last 24 hours. This dashlet plots a line chart which displays the sum of all the records indexed along with the total volume of data (sum of bytes) indexed in the last 24 hours. By looking at the chart, you can understand the amount of data indexed by the product and also the kind of data load handled by the product. Example: If you see a sudden dip in the record count on a particular day, it might indicate that some data collectors or the Collection Stations (or Collection Agents) are not working. The information represented on this dashlet can also provide an insight about the amount of data generated by the applications that you are monitoring. In this chart, the following apply: X axis represents the date and time for the last seven days. Y axis on the left, represents sum of records indexed per day. Y axis on the right, represents the total volume of data (sum of bytes) indexed per day. By default, the legend is hidden. To show legend, select the Show Legend check box. For more information, see Monitoring-the-product-metric-files.
Top 5 data collectors by volume	Provides a glimpse of the top five data collectors that are collecting the maximum volume of data compared to other data collectors present in the system. This information can help you understand the distribution of data load across data collectors.
Total collection polls with "no data"	Provides a glimpse of the total number of polls with no data collected. This information can help you monitor if the data collection is successful or not. Polls with no data can occur in the following two scenarios: The target files do not contain any data. Data collection did not happen successfully due to some problems or failures. You can navigate to the Administration > Data Collectors page to find out data collectors with the status showing red. For more information, see Understanding-the-data-collection-status. You can also correlate this dashlet with the dashlet indicating the top five data collectors with no data polled. Also, you can see the troubleshooting scenarios with respect to data collection listed at Troubleshooting-common-issues.
Top 5 data collectors with "no data" polls	Provides a glimpse of the top five data collectors with no data polled. These data collectors indicate data collectors with the maximum number of polls with no data. You can correlate this dashlet with the dashlet indicating the total number of collection polls with no data collected. This dashlet can give you insights into the problem data collectors which are no polling data successfully. You can see the troubleshooting scenarios with respect to data collection listed at Troubleshooting-common-issues.

Adding dashboards and dashlets

A dashlet is one of the four quadrants that appear on a dashboard page. You can add dashlets to see a graphic representation of the saved search results for data monitoring purposes. The graphical representation is available in the form of various charts. For example, bar diagram pie chart, line chart, and so on.

By default, a dashlet provides details about search results displayed on the Search tab within one minute.

To change this time limit, you can add the indexing.psJobGetMoreTimeoutInmsec property by navigating to the searchserviceCustomConfig.properties file. This property defines the time limit (in milliseconds) after which the search (including notifications and views) times out. For more information, see Modifying-the-configuration-files.

You can add a dashlet by using the Dashboards tab or by using the Saved Searches tab.

The following instructions describe the procedure for adding a dashboard and dashlets and the various actions available while adding or editing dashlets.

Adding a dashboard
Adding a dashlet from the Dashboards tab
Adding a dashlet from the Saved Searches tab
Actions available for dashboards and dashlets

Adding a dashboard

You can add a dashboard from the Dashboads page. Alternatively, you can also add a dashboard from the Saved Searches tab. For more information, see Adding a dashlet from the Saved Searches tab.

Navigate to the Dashboards page.
Click the Add new dashboard icon next to the Default dashboard page.
Provide dashboard name and click Create.

Adding a dashlet from the Dashboards tab

You can add a dashlet by navigating to an existing dashboard page or by adding a new dashboard page first.

Navigate to the appropriate dashboard page, under the Dashboards tab, and click one of the four quadrants on the page.
Provide the following details and then click Create:
- Dashlet Name: Provide a title for the chart that you want to add in the dashlet.
- Saved Search: Type or select the saved search for which you want to summarize search results in the form of a chart.
  Tip
  While typing the saved search name, you can specify any portion of the saved search name. You can even specify the content pack name via which the saved search was imported. Saved searches imported via a content pack are suffixed with the content pack name; the content pack name is displayed in square brackets.
  Also, consider reading the notes about using a saved search in a dashlet.
- Search String: Displays the search string corresponding to the saved search selected.
- Summarization Field: Select the field name or tag name by which you want to summarize your search results data in the dashlet.
- Chart Type: Select one of the following chart types to summarize your search results:

Adding a dashlet from the Saved Searches tab

Navigate to the Saved Searches tab.
Select the saved search that you want to add to the dashboard page, and click Add to Dashboard .
Note
You cannot add a saved search to a dashboard in the following scenarios:
- If the saved search has a custom time context because this type of saved search provides absolute results.
- If the saved search contains a search query that uses the stats-search-command command without the group by parameter. Creating a dashlet for such a query does not provide meaningful representation of data.
  For example, in the following search query, there is no field specified to group the search results.
  * | stats count(HOST)
On the Add to Dashboard dialog box, provide the following details:
- Summarization Field: Select the field name by which you want to summarize your search results data in the dashlet.
  You can select from a list of fields which are available on the Filters panel on the Search tab and all the tags which are available in the system. You can add more fields to this list by adding more fields to the Fields section, on the Filters panel. If the saved search contains a search query that returns tabular output (for example timechart-search-command, stats-search-command commands), then the fields displayed in the list are derived from the tabular data.
- Chart Type: Select one of the following chart types to summarize your search results:
  Note
  The pie and doughnut charts are not supported for saved searches that return tabular output. For example, timechart-search-command command.
- Dashboard: Select one of the existing dashboard pages to add the search results data to that dashboard page. If you want to add the search results data to a new dashboard page, then create the new dashboard page by selecting Create new and provide a name for the dashboard in the Dashboard box.
- Dashlet Name: Provide a title for the summarization chart that you want to add in the dashlet.
- On the Location grid, click the box in which your search results are to be displayed.s
  If a dashlet is already plotted on one of the four boxes, then the dashlet name appears on that box.
- Click Add.
  You can see the saved search details summarized in the form of a chart on the Dashboards tab (on the specified dashboard page).

For more information about saved searches, see Saving-and-sharing-searches-for-analytics-and-monitoring .

Actions available for dashboards and dashlets

The following table lists the various actions that you can perform on dashboards and dashlets available under the Dashboards tab:

Setting custom dashboard pages as the product landing page

By default the Default dashboard page is set as the landing page when you log on to the product. You can change the landing page to show another existing dashboard page.

To do this, navigate to Settings > User Settings, and select the correct option available in the Landing Page list.

Notes about using a saved search in a dashlet

The following notes are important to keep in mind while selecting a saved search to add a dashlet:

Saved searches imported via a content pack are subject to changes with a content pack update. If you want to avoid any future changes made to the saved search (that is used in the dashboard), you can first clone the saved search by navigating to the Saved Searches tab and then create the dashboard based on the cloned copy. For more information about the changes that can occur with a content pack update, see Creating-and-managing-content-packs.
If your saved search string includes a search command that provides tabular outputs (for example, the timechart-search-command command), the option to represent the search results in the form of a chart is unavailable. For more information about tabular commands, see Search-commands.
The saved search forms the basis of a dashlet. Deletion of a saved search can result in deletion of the dependent dashlet.
If you add a dashlet based on a public saved search and if that saved search is deleted, a private copy of the saved search is automatically created so that objects configured based on the deleted saved search continue to function. The private copy details are automatically updated in the dashlet and listed on the Saved Searches page. Also, the user who created the dashlet becomes the owner of the private copy. A public saved search can have the following sources. The private copy name differs based on the type of source.
- Imported via a content pack: Based on this source, the private copy is named as "Copy of <SavedSearchName> from <ContentPackName>".
- Created by another user: Based on this source, the private copy is named as "Copy of <SavedSearchName>".
Note that if the owner of a public saved search turned the saved search into a private one (by clearing the Make Public check box), then a private copy of that saved search is created. The users using the original public saved search in the dashlet become owners of the private copy. The private copy details are automatically updated in the dashlets using the saved search.