Dashboards

Create a new Dashboard in the Stroom 101 folder and call it Stroom 101.

---

By default a new Dashboard opens with two panes; a Query pane at the top to build the query; and a Table pane at the bottom to display the results. Dashboards are highly configurable; panes can be added and resized; they can contain multiple queries; and a query pane can provide data for multiple output panes (such as Visualisations ).

Configuring the query data source

On the query pane click the settings button on the top right of the panel.

---

1. Click on the Data Source document picker.
2. Select the index you created earlier:
   Stroom 101 / Stroom 101

Configuring the query expression

Now add a term to the query to filter the data.

1. Right click on the root AND operator and click Add Term. A new expression is added to the tree as a child of the operator and it has three dropdowns in it ( Field , Condition and value).
2. Create an expression term for the Application field:
   1. Field: Application
   2. Condition: =
   3. Value: *b*

This will find any records with b in the Application field value.

Configuring the table

All fields are stored in our index so we do not need to worry about configuring Search Extraction .

We first need to add some columns to our table. Using the button on the Table pane, add the following columns to the table. We want a count of records grouped by Application.

• Application
• Count

To group our data by Application we need to apply a group level to the Application column.

1. Click on the Application column
2. Click
   Group => Level 1

Now we can reverse sort the data in the table by the count.

1. Click on the Count column.
2. Click
   Sort => Sort Z to A

Now click the large green and white play button to run the query. You should see 15 Applications and their counts returned in the table.

Now we are going to add a custom column to show the lowest EventId for each Application group.

1. Click on the button on the Table pane.
2. Select Custom (at the bottom of the list).
3. Click on the new Custom column.
4. Click
   Expression
5. In the Set Expression For ‘Custom’ dialog enter the following:
   first(${EventId})
6. Click OK.

Instead of typing out the expression you can use the and buttons to pick from a list to add expressions and fields respectively. You can also use Ctrl ^ + Space ␣ to auto-complete your expressions.

To rename the Custom column:

1. Click on the Custom column.
2. Click
   Rename
3. Enter the text First Event ID.
4. Clico OK.

Now run the query again to see the results with the added column.

Add a visualisation

We will add a new pane to the dashboard to display a Visualisation .

1. Click on the button at the top left of the Dashboard.
2. Select Visualisation.

A new empty Visualisation pane will be added at the bottom of the Dashboard.

To configure the visualisation:

1. Click on the button at the top right of the Visualisation pane.
2. In the Visualisation document picker select
   Visualisations / Version3 / Bubble
3. Click OK.
4. On the Data tab that has now appeared in the dialog, assign the following table fields to the visualisation:
   1. Name: Application
   2. Value: Count
   3. Series: Application
5. On the Bubble tab on the dialog, set the following:
   1. Show Labels: True
6. Click OK.

To change the look of your Dashboard you can drag the different panes around into different positons.

1. Click and hold on the Visualisation text in the top left of the Visualisation pane.
2. Drag the cursor to the right hand side of the Table pane. You will see a purple rectangle showing where the pane will be moved to.
3. Once you are happy with the position release the mouse button.
4. Click and hold the mouse button on the borders between the panes to resize the panes to suit.
5. Click to save the Dashboard.

You should now see something like this:

---