Changing the Chart Type on the Log Monitoring Dashboard

After performing a search operation, the Search page displays the number of log events in a bar chart. You can change the chart by adding commands to your search.

Use the following table to determine the type of chart you want to view.

Pie Chart Time Chart
Syntax: yourSearchCriterion | graphtype pie fieldName

where:

  • yourSearchCriterion is your original search criterion. For additional information, see Searching Log Data.
  • fieldName is the log property that you want to capture from the log events. For additional information, see Field Names.

Description: Displays the log event percentage and count for the log property you defined in fieldName, for example, MonitoringPolicyName. If multiple values for fieldName are found, the 10 values with the most matching log events are displayed.

Example: If you specify MonitoringPolicyName as the fieldName, the chart displays the number of log events that occurred for each monitoring policy. See the following sample chart for a graphical illustration:

Syntax:
  • yourSearchCriterion | graphtype timechart count by fieldName
  • yourSearchCriterion | graphtype timechart min|max|avg(integerFieldName) by fieldName

where:

  • yourSearchCriterion is your original search criterion. For additional information, see Searching Log Data.
  • fieldName is the log property that you want to capture from the log events. For additional information, see Field Names.
  • integerFieldName is the log property that you want to find the minimum, maximum, or average of. This value defines the vertical (y) axis of the time chart.

Description:

  • count by syntax: Displays the log event count for the log property you defined in fieldName, for example, ClientName.
  • min|max|avg syntax: Displays the minimum, maximum, or average number of integerFieldName for the log property you defined in fieldName, for example, avg(PID) by ClientName.

If multiple values for fieldName are found, the 10 values with the most matching log events are displayed. The chart provides the number of log events that occurred at every hour for a fixed number of days.

Example: If you specify ClientName as the "count by" fieldName, the chart displays the number of log events that occurred for the clients at every hour across eight days. See the following sample chart for a graphical illustration:

Donut Chart Comparison Chart
Syntax: yourSearchCriterion | graphtype donut fieldName1, fieldName2

where:

  • yourSearchCriterion is your original search criterion. For additional information, see Searching Log Data.
  • fieldName1 and fieldName2 are log properties that you want to capture from the log events. For additional information, see Field Names.

Description: Displays the log event percentage and count for the log property you defined in fieldName2 based on fieldName1, for example, TemplateName and MonitoringPolicyName. If multiple values for fieldName2 are found, the five values with the most matching log events based on fieldName1 are displayed.

In the donut chart, the the inner circle shows the log events for fieldName1 and the outer circle shows the log events for fieldName2.

Example: If you specify TemplateName as fieldName1 and MonitoringPolicyName as fieldName2, the chart displays the number of log events that occurred for the monitoring policies, based on the monitoring policy templates. See the following sample chart for a graphical illustration:

Syntax:
  • yourSearchCriterion | graphtype compare n
  • yourSearchCriterion | graphtype compare min|max|avg(integerFieldName), min|max|avg(integerFieldName)

where:

  • yourSearchCriterion is your original search criterion. For additional information, see Searching Log Data.
  • n is the number of log events that you want to compare across time. You can compare up to 10 log events.
  • integerFieldName is the log property that you want to compare the minimum, maximum, or average of. This value defines the vertical (y) axis of the time chart.

Description:

  • compare n syntax: Compares the number of log events you defined in n, for example, 5. The log events depend on your search criterion.
  • min|max|avg syntax: Compares the minimum, maximum, or average number of integerFieldName with another minimum, maximum, or average number of integerFieldName for the log events from your search criterion, for example, min(JobId), max(JobId).

The chart provides the log events in a time line.

Example: If you specify 2 as n, the chart compares two log events over the course of eight days. See the following sample chart for a graphical illustration:

You can analyze, monitor, and compare large amounts of log data from multiple clients in your environment by using the Comparison Chart.

For more information, see Monitoring and Comparing Log Data using Graphs.

Field Names

A fieldName is a log file property that you can capture from a log event. Most field names are based on the filters that you can see on the lower left corner of the Search page.

Before you type the fieldName next to the command to change the chart, the Search bar displays a list of available field names that you can use. The list might vary based on the monitoring policy templates being processed.