Grouped Report type allows you to group all the column results according to the query written on Search Bar. For example, if you want to see the IP addresses that make connections from inside network to outside, you can type the query as "Source.Position:in Destination.Position:out" and then select the grouped column as Source.IP. Now, you are able to see the network traffic of the IP addresses from inside to outside.
To create a Grouped Report, follow the steps given below:
1- As a first step, prepare the query for the report on the Search page as shown in the example below. Then, click the + Report button above the search results. The report form opens with your query (including any filters you applied) already filled in.
2- The report form has two steps: Report (Set Information) and Query (Set Query). In the first step, select Grouped as the Report Type and fill in the fields as given below:
Report Name: Enter report name. This is a required field.
Report Note: Optional text shown under the report title in PDF and HTML exports.
Report Type: Select Grouped. It is the default selection.
Time Column: This field is predefined as Time.Generated. The report uses the value of the selected column as time. Only date type columns of the selected index are listed.
Report Block: Select report block for report. If you select Add New Block, a Block Name field appears and a new block is created with that name when the report is saved.
Category: Select category for report: General (default), Custom/My Report, Compliance or Vendor Specific.
Roles: Select the roles for the report. This is not a required field.
Compliance: Select compliance for report (FISMA, PCI_DSS, ISO27001, HIPAA, SOX, GLBA). This is not a required field.
Index: This field is predefined as Events, which creates the report from the indexed logs. You can also select Incidents or Responses. The column names will be changed according to the index type. The last option is Offline. If you select Offline, you can create report with reindexed logs from archive.
Tags: Select tag for report. This is not a required field.
Click Next to continue to the second step and fill in the fields as given below:
Query: You can input your query in this field. If you created the report from the search page with the + Report button, it is already filled with your search query. You can also check Select Query From Report to copy the query of an existing report.
Grouped Column: The Grouped report structure will be configured by this column. This is a required field.
Row Count: Determines how many rows the report shows. The default value is 50.
Min. Event Count: The minimum number of events a grouped value must have to be shown in the report. Values with fewer events are left out. For example, if you want to see only the web sites that were accessed at least 10 times, set this field to 10. The default value is 1, which shows every web site accessed at least once.
Filter Fields: Select which columns can be used for filtering the report. This is a required field. You can also check Select Filter From Fieldsets and pick a fieldset to fill this field with its columns.
Graph Type: Here you have 5 types of graphs: Pie Chart, Column Chart (default), Bar Chart, Line Chart and Area Chart.
Chart Colors: Select the color palette of the graph.
3- Click Save button to see the report