Dashboards and visualizations
Dashboards and visualizations
Section titled “Dashboards and visualizations”A dashboard is a combination of charts, visualization components, template variables and drill-down actions over one screen, so a set of related metrics is watched together. Reports (the saved searches from search-analysis.md) are added to dashboards, and dashboards are what an operator leaves up.
Creating a dashboard
Section titled “Creating a dashboard”Two routes in:
- From a report — save a configured search/analysis report and add it to a dashboard.
- From the dashboard list — Dashboard → List, Add dashboard, name and description.
The dashboard editor then places charts. Chart groups organise a screen — create, edit (rename, background color), delete a group (with or without its contents).
Chart configuration
Section titled “Chart configuration”Each chart is a visualization of a query:
- Query — the SonQL statement (see search-sonql-reference.md) or an interactive configuration.
- Chart type — the visualization library: single-value, line, area, bar, pie, table, histogram, heat map, map, and the rest of the catalog.
- Template variables — named placeholders (
$var$) bound to a query or a field list, so one dashboard switches context (environment, service, repo) without editing every chart. - Drill-down — a chart can jump to a search, report or URL on interaction.
Configuring a chart interactively
Section titled “Configuring a chart interactively”A chart’s data can be configured without writing SonQL, in the Data Configuration panel of the visualization:
- Metrics — the aggregations the chart plots: field count, distinct count,
sum, average, median, maximum, minimum. Average/sum/max/min accept a
formula, e.g.
_value * (60 * 60), and a display name (so a shared chart reads clearly). - Grouping fields — how the data is aggregated. A time field groups into intervals (automatic or a value you set); with several grouping fields you choose which is the X-axis and which becomes multiple series.
- Filter — narrow the aggregated results; only rows meeting the filter are charted.
- Sort — the sort metric and direction (ascending/descending).
- Limit — how many rows the chart may show.
An SPL-statement search (e.g. search2 repo="default" | stats count() as count by _time) switches to the Visualization tab as a line chart, which can then be
restyled — chart type, fonts, stacking, axes — the same interactive builder
underneath.
Dashboard operations
Section titled “Dashboard operations”| action | what it does |
|---|---|
| Refresh | auto-refresh interval for all charts on the screen |
| Time range | switch the window all charts query |
| Display style | black or white background |
| Full screen | presentation mode |
| Export | export the dashboard as profile / image / PDF |
| Chart download | per-chart data export as JSON, CSV, TSV (the download icon on a chart) |
Editing an existing chart exports its configuration as a SonQL search
statement (exportxmltooltip), so a configured chart becomes a query — the
reverse of building a chart from a query.
Report subscriptions
Section titled “Report subscriptions”Dashboard → Task Manage holds report subscriptions — dashboards and reports delivered on a schedule, the dashboard-side analogue of the report mechanism in interactive-search.md.