Typically transactional data is quite detailed and analyzing an entire dataset on a graph is not feasible. Generally such data is analyzed using some form of aggregation or frequency distribution. One of the specialized charts generally used in Reporting Services for statistical distribution is Histogram Charts. In this tip you look at how Histogram Charts can be used for statistical distribution analysis and how to create and configure this type of chart in Logsign.
You can create a report in two ways. You can run your query on the Search page and click the + Report button there, or you can open the Reports page and click the + Report button. We recommend checking your query on the Search page first so you can see its results before you build the report.
1. Go to Search and build your query.
2. Build a report based on the result. Click + Report under the Search bar. The Report Form window opens with your query and index already filled in.
- The form has two steps: Report (Set Information) and Query (Set Query). In the first step, select Histogram in the Report Type list, fill in the fields and click Next. The fields are described below.
Report Name: Enter the report name. This is a required field.
Report Note: Optional text shown under the report title in PDF and HTML exports.
Report Type: Must be selected as Histogram.
Time Column: Defaults to the Time.Generated column. Only date-type columns of the selected index are listed. The report uses the value of this column as the time of each record.
Report Block: Select the report block the report belongs to. You can also choose Add New Block and type a name in the Block Name field to create a new block.
Category: Select a category for the report: General, Custom/My Report, Compliance or Vendor Specific. Defaults to General.
Roles: Select the roles that can access the report. This is not a required field.
Compliance: Select one or more compliance standards for the report (FISMA, PCI_DSS, ISO27001, HIPAA, SOX, GLBA). This is not a required field.
Index: Defaults to Events, which builds the report from indexed logs. You can also select Incidents or Responses. The column lists in the form change according to the selected index. The last option is Offline. If you select Offline, an Index list appears and you can build the report from logs re-indexed from the archive.
Tags: Select tags for the report. This is not a required field.
4. In the second step, fill in the query settings below.
Query: Enter your query. If you started from the Search page with the + Report button, this field is filled with your search query. You can also use the Select Query From Report option to copy the query of an existing report.
Time Interval: The length of each histogram bar. Options are 24 hours, 60 minutes, 30 minutes, 15 minutes, 10 minutes, 5 minutes and 1 minute. This is a required field.
Row Count: The number of rows shown per page. Defaults to 50.
Filter Fields: Select the columns that can be used to filter the report. You can tick Select Filter From Fieldsets to load the columns of an existing fieldset. This is a required field.
Chart Colors: Select the color palette of the chart.
5. Click Save to create the report.