Introduction
Choosing the right widget type depends on the data you want to analyze and the values you want to see. Logsign offers 28 different widget types that can be used without any limit. This article explains how to create a new dashboard and reviews the most commonly used widget types.
Creating Dashboard
On the Dashboards page, click the New Dashboard button. A window titled New Dashboard opens.
Enter the dashboard Name and select a Category. You can also fill in the optional Tags and Roles fields. Click Create.
The next step is adding widgets to the dashboard you created.
Click the + button on the dashboard. The Add New Widget window opens. Select the widget from the list on the left according to the type of analysis you want to perform. You can use the Search widgets... box to find a widget by name.
Each widget has its own set of fields. For example, to analyze how events are distributed over time, a Histogram type widget is the most suitable choice.
The common fields of the widget form are described below. Not every field is shown for every widget type.
Title: The name of the widget. In this example, IP Analysis is used as the title.
Index: The data source of the widget. There are three options: Events, Incidents and Responses.
Events reads data from the logs collected by Logsign.
Incidents should be selected for the records generated by incidents in Logsign.
Query: In addition to the Grouped Column that shapes the widget, you can write a manual query in the Query field. Use the * character to include all logs. To use a saved Mini Query, type @@ in the field and select the mini query from the list.
Time Column: The date column used to place the data on the time axis. The default value is Time.Generated.
Grouped Column: The column whose values are grouped and displayed in the widget.
Time Interval: Specifies the interval of the historical data presented in the graph. The options are 1 day, 60 minutes, 30 minutes, 15 minutes, 10 minutes, 5 minutes and 1 minute.
Order Type: The criterion used to sort the grouped values in the widget. The options are Count, Reverse Count, Term and Reverse Term.
Refresh Time: How often the widget is refreshed. The options range from 5 sec to 10 min.
Row Size: The number of rows (grouped values) displayed in the widget.
Multiple Row Per Page: Available on widgets that have a second column, such as Grouped Data w Label, Grouped Data w Color and Tree Map. It determines how many rows are displayed under each result in the widget.
Use Widget Time Range: When this option is selected, the Time Range field appears. Time Range determines how far back the widget reads data, from 15 minutes up to 1 month (30 days). When this option is not selected, the widget uses the time range of the dashboard.
Pie Chart
The Pie Chart widget displays the grouped values as pie slices, so you can see the share of each value in the total.
Bar Chart
The Bar Chart widget displays the grouped values as bars.
Histogram With Sparkline
As the name implies, it is the type of widget on which you can graphically view the temporal distribution of events.
Bandwidth Widget
With the Bandwidth Widget, you can view the network traffic consumed by users in KB, MB or GB. The Historical Bandwidth Widget shows the same information over time.
Table Widget
When performing a visual analysis of the logs collected by Logsign, you can display the data columns in table format. For this kind of analysis, use the Table Widget and select the columns to display in the Table Columns field.
Scatter Chart
Logsign allows the user to analyze more efficiently with various graphical forms after the necessary events are filtered out. Scatter Chart widget shows the distribution of the events based on calculated values. It also allows you to view two different data sets using cartesian coordinates. Data is indicated by dots on the chart, and their location varies vertically and horizontally.
Map Widget
The Map widget shows the distribution of events in your system by country on a map.
Nested Grouped
In the example below, you want to see which incident name belongs to which incident category. For this, use the Nested Grouped widget, which displays more than one column of information nested.
Select Alert.Info in the Grouped Column field to see the incident categories, and select Action.Object, the object that triggers incidents, in the Nested Column field. Select the column to be calculated in the Value Column field. Then enter a star (*) in the Query field to include all records.
Number Ticker & Number Ticker Histogram
The number of logs in any system can be seen with the Number Ticker widget.
The Number Ticker Histogram widget shows the same number together with its distribution over time. It can be used while performing time-based analysis.
Tree Map Widget
The Tree Map widget displays the data as nested rectangles. Each main rectangle is a value of the Grouped Column, and the rectangles inside it are the values of the Nested Column.
Please note that: If you click a category in the Tree Map widget, you are taken to the subcategories of that main category. On this view you can see which log data sets are under which category.
In the example below, the alarm records are grouped by time. Select Time.Generated in the Grouped Column field and Alert.Info in the Nested Column field. The main rectangles then show the time values, and the rectangles inside them show the alarm names. Select at least one column in the Table Columns field. This field is required. Then enter the DataType:alert Severity.ID:[0 TO 4] query in the Query field to use the alarm records.
If you click on each category, you'll see the subcategories.
System Stats
You can view the CPU, memory, disk and network status of the Logsign server with the System Stats widget. Select what to display in the Widget Type field. The options are Disk Usage, Disk Historical, Cpu Historical, Cpu Usage, Memory Historical, Memory Usage and Network Utilization. In this example, the disk status or CPU utilization is displayed.
The form also has an optional Hostname field and a required Time Interval field. Click Preview to see the result before you save the widget.
EPS Stats
It is the widget where you can see the number of events processed by Logsign per second. When you select the Eps Stats widget in the Add New Widget window, Logsign calculates the result without requiring any query. After you enter a Title, select the data to display in the Widget Type field. The options are Event Per Second, Filtered, Drop and Persisted. Select Event Per Second to see the number of events happening at the moment.
The form also has an optional Hostname field and a required Time Interval field. Click Preview to see the result before you save the widget.