A Table report is an interactive way to quickly summarize large amounts of data. Use a Table report to analyze numerical data in detail and to answer unanticipated questions about your data. A Table report is especially designed for:
- Querying large amounts of data in many user-friendly ways.
- Summarizing data by categories and subcategories.
- Expanding levels of data to focus your results, and drilling down to details from the summary data for areas of interest to you.
- Filtering, sorting, grouping, and conditionally formatting the most useful and interesting subset of data to enable you to focus on the information that you want.
- Presenting concise, attractive, and annotated online or printed reports.
You can use table report when you want to see and analyze many columns in one line.
You can create a report in two ways. You can run your query on the Search page and click the "+ Report" button there, or you can go to the Reports page and click the "+ Report" button. We recommend checking your query on the Search page before you create the report, so you can see the results of the query first.
- Go to Search and build query strings.
- Now, you can build a report based on the presented result. Click "+ Report" on the Search page. The Report Form opens and the query (including any filters you applied) is filled in automatically.
- The Report Form has two steps: Report (Set Information) and Query (Set Query). In the first step, select "Table" in the Report Type list and provide the required information. The description of fields is as below.
Fields in the Report step:
Report Name: Enter report name. This is a required field.
Report Note: Optional description that is shown under the report title in PDF and HTML exports.
Report Type: Select Table.
Time Column: This field is predefined as Time.Generated. The list contains the date type columns of the selected index, and the report uses the selected column value as time.
Report Block: Select the report block for the report. You can also select Add New Block and enter a Block Name to create a new block.
Category: Select category for report. The options are General, Custom/My Report, Compliance and Vendor Specific. The default is General.
Roles: Select the roles for the report. This is not a required field.
Compliance: Select compliance for report (FISMA, PCI_DSS, ISO27001, HIPAA, SOX, GLBA). This is not a required field.
Index: This field is predefined as Events. Select Events to create the report from indexed logs. You can also select Incidents or Responses. The column names will be changed according to the index. The last option is Offline. If you select Offline, an additional Index list appears and you can create the report with logs reindexed from the archive.
Tags: Select tag for report. This is not a required field.
Click Next to continue. Fields in the Query step:
Query: You can input your query in this field. If you input your query on the Search page and click "+ Report", the query is filled automatically. You can also tick Select Query From Report and pick the query of an existing report.
Report Columns: Select which columns are shown in the report. You can also tick Select Columns From Fieldsets to fill the columns from a fieldset.
Order By: Tick this box to sort the report by a column. Then select the Order By Column and the Order By Direction (Ascending or Descending).
Row Count: Determine how many rows are shown per page. The default is 50.
Filter Fields: Select which columns can be used for filtering. You can also tick Select Filter From Fieldsets to fill the filter fields from a fieldset.
- After you click "Save", the new report opens and you will see the result as below.