Kaspersky Unified Monitoring and Analysis Platform

Presets

April 8, 2024

ID 242466

You can use presets to simplify work with queries if you regularly view data for a specific set of event fields. In the line with the SQL query, you can type Select * and select a saved preset; in that case, the output is limited only to the fields specified in the preset. This method slows down performance but eliminates the need to write a query manually every time.
Presets are saved on the KUMA Core server and are available to all KUMA users of the specified tenant.

To create a preset:

  1. In the Events section, click the icon.
  2. In the window that opens, on the Event field columns tab, select the required fields.

    To simplify your search, you can start typing the field name in the Search area. 

  3. To save the selected fields, click Save current preset.

    The New preset window opens.

  4. In the window that opens, specify the Name of the preset, and in the drop-down list, select the Tenant.
  5. Click Save.

    The preset is created and saved.

To apply a preset:

  1. In the query entry field, enter Select *.
  2. In the Events section of the KUMA web interface, click the icon.
  3. In the opened window, use the Presets tab to select the relevant preset and click the button.

    The fields from the selected preset are added to the SQL query field, and the columns are added to the table. No changes are made in Builder.

  4. Click SearchField to execute the query.

    After the query execution completes, the columns are filled in.

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.