The Grouped Plus report type lets you add more than one column to a grouped report and run mathematical calculations on the results collected from your sources.
As the ∑ symbol suggests, this report type can calculate sums. For example, you can create a report that shows how much each user downloaded, grouped by IP address or username.
You can see either the total bandwidth usage (Bytes.Received + Bytes.Sent) or just the download amount (Bytes.Received) by selecting the sum columns.
Follow the steps below to create a Grouped Plus report.
1- On the Search page, click + Report. The query you entered on the Search page is carried over to the report form.
2- The report form has two steps: Report (Set Information) and Query (Set Query). In the first step, select Grouped Plus as the Report Type and fill in the fields below. Then click Next.
Report Name: Enter the report name. This is a required field.
Report Note: Optionally, add a note for the report.
Time Column: This field is predefined as the Time.Generated column. The report uses the value of the selected column as its time. Only date-type columns of the selected index are listed.
Report Block: Select the report block for the report. This is a required field. You can also select Add New Block and enter a Block Name to create a new block.
Category: Select the category for the report: General, Custom/My Report, Compliance or Vendor Specific. This is a required field and is predefined as General.
Roles: Select the roles for the report. This is not a required field.
Compliance: Select a compliance standard for the report (FISMA, PCI_DSS, ISO27001, HIPAA, SOX, GLBA). This is not a required field.
Index: This field is predefined as Events. Select Events to report on collected logs, Incidents to report on incidents, or Responses to report on responses. The column names change according to the selected index. The Offline option (reports on reindexed archive logs) is not available for the Grouped Plus report type.
Tags: Select tags for the report. This is not a required field.
3- In the Query step, fill in the fields below.
Query: Enter your query in this field. If you entered a query on the Search page and clicked + Report, this field is filled with that query automatically. You can also use Select Query From Report to copy the query of an existing report.
Grouped Column: The grouped report structure is built on this column. This is a required field.
Row Count: Set the number of rows to show in the report. The default value is 50.
Min. Event Count: The minimum number of logs a group must have to be shown in the report. Groups with fewer logs than this value are not shown. For example, to see only the web sites that were accessed at least 10 times, set this field to 10. To see all web sites accessed at least once, set it to 1. The default value is 1.
Sum Columns: Select the columns whose results will be summed.
Sum Column Attributes (Unit and Convert): After you select the sum columns, select a Unit for each column: KB, MB, GB or Other. For example, select MB or GB to convert the bandwidth sums, which are collected in bytes.
When you select KB, MB or GB, the conversion formula is applied automatically (/1024, /(1024*1024) or /(1024*1024*1024)). If you select Other, enter a Unit Name and a Convert formula yourself. The formula must start with an arithmetic operator, for example /(1024*1024).
Avg Columns: Select the columns whose average value will be calculated.
Value Columns: Select a column to view the count of that column's values according to the query.
Unique Columns: The selected columns show the unique count of their values according to the query.
Term Columns: You can view more column results according to the query in this field. For example, if you grouped the results by IP address, you can also add the username column here to see the usernames of those IP addresses. You can set a Row Size for each term column.
Order By: Select this checkbox to set a custom order for the results. Then select the Order By Type as Term, Count, Value Count, Unique or Sum. For Value Count, Unique and Sum, also select the Order By Column. Finally, select the Order By Direction as Ascending or Descending.
Filter Fields: Select the columns that can be used to filter the report. This is a required field. You can also use Select Filter From Fieldsets to load the columns of an existing fieldset.
Graph Type: Here you have 4 types of graphs: Column Chart, Bar Chart, Line Chart or Area Chart. The default is Column Chart. Pie Chart is not available for this report type.
Chart Colors: Select the color palette of the report chart.
Click the Save button to create the report.