Graph

Graph type. The following graph types are available:

• Bar chart.
• Pie chart.
• Counter.
• Table.

Tenant

The tenant for which data is displayed in the widget. You can select multiple tenants. By default, data is displayed for tenants selected in layout settings.

Correlator

The name of the correlator that contains the active list for which you want to receive data.

Active list

The name of the active list for which you want to receive data.

The same active list can be used by different correlators. However, a separate entity of the active list is created for each correlator. Therefore, the contents of the active lists used by different correlators differ even if the active lists have the same names and IDs.

SQL query field

This field lets you manually enter a query for filtering and searching active list data.

The query structure is similar to that used in event search.

When creating a query based on active lists, you must consider the following:

• For the FROM function, you must specify the `records` value.
• If you want to receive data for fields whose names contain spaces and Cyrillic characters, you must also enclose such names in quotes in the query:
  • In the SELECT function, enclose aliases in double quotes or backticks: "alias", `another alias`.
  • In the ORDER BY function, enclose aliases in backticks: `another alias`.
  • Event field values ​​are enclosed in straight quotes: WHERE DeviceProduct = 'Microsoft'.
• Names of event fields do not need to be enclosed in quotes.
• If the name of an active list field begins or ends with spaces, these spaces are not displayed by the widget. The field name must not contain spaces only.
• If the values of the active list fields contain trailing or leading spaces, it is recommended to use the LIKE '%field value%' function to search by them.
• In your query, you can use service fields: _key (the field with the keys of active list records) and _count (the number of times this record has been added to the active list), as well as custom fields.
• The "metric" and "value" aliases in SQL queries cannot be edited for any type of active lists analytics widget, except tables.
• If a date and time conversion function is used in an SQL query (for example, fromUnixTimestamp64Milli) and the field being processed does not contain a date and time, an error will be displayed in the widget. To avoid this, use functions that can handle a null value. Example: SELECT _key, fromUnixTimestamp64Milli(toInt64OrNull(DateTime)) as Date FROM `records` LIMIT 250.
• Large values for the LIMIT function may lead to browser errors.
• If you select Counter as the graph type, you must specify the method of data processing for the values of the SELECT function: count, max, min, avg, sum.

Special considerations apply when using aliases in SQL functions and SELECT, you can use double quotes and backticks: ", `.

If you selected Counter as the graph type, aliases can contain Latin and Cyrillic characters, as well as spaces. When using spaces or Cyrillic, the alias must be enclosed in quotation marks: "An alias with a space", `Another alias`.

When displaying data for the previous period, sorting by the count(ID) parameter may not work correctly. It is recommended to sort by the metric parameter. For example, SELECT count(ID) AS "metric", Name AS "value" FROM `events` GROUP BY Name ORDER BY metric ASC LIMIT 250.

Sample SQL queries for receiving analytics based on active lists:

• SELECT * FROM `records` WHERE "Event source" = 'Johannesburg' LIMIT 250

  This query returns the key of the active list where the field name is "Event source" and the value of this field is "Johannesburg".

• SELECT count(_key) AS metric, Status AS value FROM `records` GROUP BY value ORDER BY metric DESC LIMIT 250

  Query for a pie chart, which returns the number of keys in the active list ('count' aggregation over the '_key' field) and all variants of the Status custom field. The widget displays a pie chart with the total number of records in the active list, divided proportionally by the number of possible values for the Status field.

• SELECT Name, Status, _count AS Number FROM `records` WHERE Description ILIKE '%ftp%' ORDER BY Name DESC LIMIT 250

  Query for a table, which returns the values ​​of the Name and Status custom fields, as well as the service field '_count' for those records of the active list in which the value of the Description custom field matches ILIKE '%ftp%'. The widget displays a table with the Status, Name, and Number columns.

Y-min and Y-max

Scale of the Y axis.

Negative values can be displayed on chart axes. This is due to the scaling of charts on the widget and can be fixed by setting zero as the minimum chart values instead of Auto.

X-min and X-max

Scale of the X axis.

Negative values can be displayed on chart axes. This is due to the scaling of charts on the widget and can be fixed by setting zero as the minimum chart values instead of Auto.

Name

Name of the widget.

Description

Description of the widget.

Color

The color used for displaying the information:

• default for your browser's default font color
• green
• red
• blue
• yellow

Horizontal

Makes the histogram horizontal instead of vertical.

When this setting is enabled, all available information is fitted into the configured widget size. If the amount of data is great, you can increase the size of the widget to display it optimally.

Show total

Shows sums total of the values.

Show legend

Displays a legend for the analytics. The toggle switch is turned on by default.

Show nulls in legend

Displays parameters with a null value in the legend for analytics. The toggle switch is turned off by default.