Graph Area
The Graph Area user interface includes the following elements:
Element | Description |
---|---|
Graph toolbar | Includes icons for defining the graph visualization and content. |
Main Graph | A graph that displays the distribution of events over time. The search query timeline is the x-axis, and the number of matching events is the y-axis. The main graph shows the distribution of events matching the search query over the selected timeline. Any time period in the graph can be zoomed into, by selecting a time on the time axis, and dragging left/right the vertical line that appears on the graph, to the beginning/end of the time period to be zoomed into. A Zoom Out button appears on top of the zoomed-in graph, enabling return to the original search results. |
Zoom-In Graph | Below the main graph. Displays zoomed-in area with respect to the original search context. For example, zooming in on one day of the last 7 days, shows in this graph all seven days, with the zoomed-in day shaded in blue. Can zoom into a time period from this graph (see explanation in Main Graph). |
Graph Toolbar
The right side of the Graph toolbar includes the following buttons for defining the type of graph to generate:
Element | Description |
---|---|
Display Line Chart button. Clicking this icon displays a line graph of the event distribution. Mouse over this icon presents below different line charts based visualization options: Display Summary View button. Clicking this button displays the event distribution originating from each log (default), application, or server (according to what you selected in the Distribute by selection box described in this table). | |
Display Column Chart button. Clicking this button displays a column (bar) graph of the event distribution. Mouse over this icon presents below different line charts based visualization options: Display Summary View button. Clicking this button displays a column chart in summary view. Display Split View button. Clicking this button displays a column chart in split view, i.e. a vertical line for each log (default), application, or server (according to what you selected in the Distribute by selection box described in this table). Display Stack View button. Clicking this button displays a column chart in stack view, i.e. a horizontal bar for each log (default), application, or server (according to what you selected in the Distribute by selection box described in this table). | |
Display Pie Chart button. Clicking this button displays a pie chart of the event distribution. | |
Display Geo Location Map button. This button is present only when Geo Location related queries are executed. Clicking this button displays a Geo Location Map of the event distribution. |
The left side of the Graph toolbar includes the following buttons for defining additional views on the graph. The available options depend on the selected type of graph:
Element | Description |
---|---|
Augmented layers selection box.
| |
Pie, Line, and Column Charts | |
Distribute by selection box. Enables selecting according to what entity to distribute the information resulting from the search: Total, Logs, Applications, or Servers. Selecting Logs/Applications/Servers changes the graph accordingly, and displays above the graph a color-coded legend of the different log/application/server names in the system. |