|      |                                                                                            Logged in as Username | Logout | Admin | Jobs (3)        | Help

Dashboards |        | Search |    | Reports |       | Alerts |   | Visualizations |         |                                                             Application Settings



   Reports                                                                                                                            search for report

       Name                                               Last Modified                 Dashboards          Type                         Preview
        Events by time                                    March 3, 2008, 11:45          -                   154kb

        Ports by firewall                                 March 4, 2008, 11:45          Main                124kb

        Application Configuration Change Report           March 5, 2008, 11:45          Change Mgmt, Main   54kb

        example2.jpg                                      March 4, 2008, 11:45          -                   124kb

        Events by time                                    March 3, 2008, 11:45          -                   154kb

        Ports by firewall                                 March 4, 2008, 11:45          Main                124kb

        Application Configuration Change Report           March 5, 2008, 11:45          Change Mgmt, Main   54kb

        example2.jpg                                      March 4, 2008, 11:45          -                   124kb


             Assign Permissions     Delete Report                                                                                                     Add Report


         view, modify, clone
         report template vs. report content
         data source(s) / summarized results / static report OR saved search / variable report


         last run, availabloe versions / historical? frequency - does it have a sched

         charts
|     |                                                                                    Logged in as Username | Logout | Admin | Jobs (3)        | Help

Dashboards |        | Search |     | Reports |    | Alerts |   | Visualizations |   |                                                            Application Settings




                                                                }
   Create Report                                                                                                             search for report



                   Clone existing report

                   select report template




                    Pick format

                                                                                        Next Step




                    Pick what you're trying to show
|       |                                                                                       Logged in as Username | Logout | Admin | Jobs (3)     | Help

Dashboards |          | Search |        | Reports |   | Alerts |   | Visualizations |   |                                                          Application Settings

< Reports Main

   New Report
     HEADER             click to edit



     CONTENT 1                                                                                                                        Actions / Preferences

      Step 1 of 2: Specify Data Set

         Use Saved Search                                          New Search

             select saved search                                    Open search template in new window

                     Review / refine search                         paste search string here


                                                                                                                                 Step 2 of 2: Format Content >



    + Add Content
|       |                                                                                             Logged in as Username | Logout | Admin | Jobs (3)     | Help

Dashboards |          | Search |        | Reports |   | Alerts |   | Visualizations |   |                                                                Application Settings

< Reports Main

   New Report
     HEADER             click to edit



     CONTENT 1                                                                                                                              Actions / Preferences

      Step 1 of 2: Specify Data Set

         Use Saved Search                                          New Search

             select saved search                                          Open search template in new window


             paste search string here
                                                                                                                                       Step 2 of 2: Format Content >




                     Review / refine search




    + Add Content
|      |                                                                          Logged in as Username | Logout | Admin | Jobs (3)        | Help

Dashboards |         | Search |     | Reports |      | Alerts |    | Visualizations |   |                                                Application Settings

< Reports Main       < Back to search


 New Report                                                                                                                             + Add Content


    Header



    Content Title                                                                                                        [ Actions / Preferences     ]

                                                                                                                           FORMAT
      Data Set
                                                                                                                           Move up | Move down
      Format                                                                                                               Half width | Full width
      CHART TYPES      TABLE
                                                                                                                           SAVE
                                                                                                                           Save Content
      DISTRIBUTION         RELATIONSHIPS     COMPARISON       TRENDS
                                                                                                                           Save to Dashboard

      Format                                                        [ Edit title ]
                                                                                                                             COLOR




                                                paste search string here




                                Review / refine search


         x-axis TIME            y-axis EVENTS - sum
|     |                                                                     Logged in as Username | Logout | Admin | Jobs (3)       | Help

Dashboards |            | Search |   | Reports |   | Alerts |   | Visualizations |   |                                               Application Settings

                                                                                                                 Timeframe: Last 24 hours
 IP Address=Foo | Host=Bar                                                                                                                      >
    Search assistance


  Save Search | Save as Alert | Export

Results




                                                                                                                              analyze / chart results
|   |                                                                                         Logged in as Username | Logout | Admin | Jobs (3)               | Help

Dashboards |          | Search |         | Reports / Charts |     | Alerts |       | Visualizations |   |                                                       Application Settings

[ < Back to search / data set ]



 Chart / Graph Results            generated: 08/09/08: 09:00
                      I want to
 Table only           CHART         distribution         trends    relationships          comparison



 table / chart fields

 x-axis primary column
 Select Field


 y-axis secondary column(s)
 Select Field




                                                                                                                  compare relationships? of a single or multiple field over time
                                                                                                                  compare values for a single or multiple field over time
|   |                                                                                                 Logged in as Username | Logout | Admin | Jobs (3)     | Help

Dashboards |          | Search |           | Reports / Charts |          | Alerts |        | Visualizations |   |                                             Application Settings

[ < Back to search / data set ]



 Chart / Graph Results            generated: 08/09/08: 09:00
                      I want to
 Table only           CHART         distribution          trends           relationships          comparison
                                      OVER TIME
                                      distribution of single field over time
 table / chart fields                 compare distribution of fields over time

                                      ??
 x-axis primary column
 Select Field                         distribution of field vs. another field


 y-axis secondary column(s)
 Select Field
|   |                                                                                           Logged in as Username | Logout | Admin | Jobs (3)               | Help

Dashboards |          | Search |         | Reports / Charts |      | Alerts |        | Visualizations |   |                                                       Application Settings

[ < Back to search / data set ]



 Chart / Graph Results            generated: 08/09/08: 09:00

 Table only           CHART         distribution          trends     relationships           comparison



 table / chart fields

 x-axis primary column
 Select Field


 y-axis secondary column(s)
 Select Field




                                                                                                                    compare relationships? of a single or multiple field over time
                                                                                                                    compare values for a single or multiple field over time
|       |                                                                                         Logged in as Username | Logout | Admin | Jobs (3)     | Help

Dashboards |              | Search |         | Reports / Charts |     | Alerts |       | Visualizations |   |                                             Application Settings

[ < Back to search / data set ]



 Chart / Graph Results                generated: 08/09/08: 09:00
                          I want to
 Table only               CHART         distribution         trends    relationships          comparison



 table / chart fields

 x-axis primary column
 Time
 Binning options...

 y-axis secondary column(s)
 Field1
 fn: sum          Modify...
|       |                                                                                         Logged in as Username | Logout | Admin | Jobs (3)     | Help

Dashboards |              | Search |         | Reports / Charts |     | Alerts |       | Visualizations |   |                                             Application Settings

[ < Back to search / data set ]



 Chart / Graph Results                generated: 08/09/08: 09:00
                          I want to
 Table only               CHART         distribution         trends    relationships          comparison



 table / chart fields

 x-axis primary column
 Time
 Binning options...

 y-axis secondary column(s)
 Field1
 fn: sum          Modify...
|    |                                                                                                                  Logged in as Username | Logout | Admin | Jobs (3)                     | Help

Dashboards |         | Search |       | Reports |         | Alerts |        | Visualizations |            |                                                                                 Application Settings

< Back to search     [ Data set ] generated: 08/09/08: 09:00


  Chart / Graph Results

     Display primary results as:
    TABLE             CHART            Show table
                                                                                                                      TRENDS          RELATIONSHIPS                  USE WHEN
                      DISTRIBUTION                                                           COMPARISON
                                                                                                                                                                           area graphs—like line
                                                                                                                                                                           graphs—are more
                                                                                                                                                                           suitable for displaying
                      Histogram       Bar        Area          Pie      Donut                Scatter      Bubble       Line           Heat map                             continuous data


     I want to see:

                    Field name                          [ All Fields... ]   fn                                        Field name                           [ All Fields... ]

      y-axis        events                                                   count                        BY x-axis    time

                                                                                                                         Split by [ Binning Options... ]

                                                                                                                      Field name                            [ All Fields... ]    Display as
      Add series                              2 scales for y
                                                                                                                       series                                                     ??
                                              axis


     Filters:


   Results presentation:                                                                                                                                                                [ Actions    ]

                                                                            [ Edit title ]
   based on data generated: 08/09/08: 09:00
                                                                                                                                                                                COLOR
RELATIONSHIPS




Heat map
A heat map is a graphical
representation of data where the values
taken by a variable in a two-
dimensional map are represented as
colors




                                          >
|   |                                                                             Logged in as Username | Logout | Admin | Jobs (3)         | Help

Dashboards |          | Search |     | Reports |        | Alerts |    | Visualizations |   |                                                Application Settings

< Back to search      [ Data set ]


  Chart / Graph Results                                                                                                   [ Actions / Preferences    ]
                                                                                                                            Save as template
     Display results as:
                                                                                                                            Save to dashboard
     TABLE           CHART
                                                                                                                            Create report




      Filters

     Format                                                          [ Edit title ]
                                                                                                                              COLOR




                                               paste search string here




                                                                                                                                            should this live in
                               Review / refine search                                                                                       search or reports? or
                                                                                                                                            should there be an
                                                                                                                                            interactive charting
        x-axis TIME            y-axis EVENTS - sum                                                                                          section that holds the
                                                                                                                                            content pieces/
                                                                                                                                            visualizations/
                                                                                                                                            projections

                                                                                                                                            - make sure I
                                                                                                                                            understand that table
                                                                                                                                            thing.
Display results as:


                     TRENDS




Line                 Line


 DISTRIBUTION                                               COMPARISON                               RELATIONSHIPS




 Histogram      Bar Chart     Pie chart      Donut            Scatter    Bubblle                     Heat map
 z-axis is      x axis is                 * Category groups, series      Bubble graphs are like      A heat map is a graphical
 continuous     categorical               groups, and values series as   scatter graphs, with a      representation of data where the values
 (e.g.. time)                             doughnut slices                third variable size. They   taken by a variable in a two-
                                                                         let you chart three         dimensional map are represented as
                                          * Typically shows percentage   variables in two            colors
                                                                         dimensions.




                                                                                                                                               >
|      |                                                                                                Logged in as Username | Logout | Admin | Jobs (3)         | Help

Dashboards |            | Search |     | Reports |       | Alerts |   | Visualizations |   |                                                                     Application Settings



   Search        [ Data set ]
                                                                                                                                            Timeframe: Last 24 hours
 IP Address=Foo | Host=Bar                                                                                                                                                    >
    Search assistance




  Chart / Graph Results                                                                                                                        [ Actions / Preferences    ]
                                                                                                                                                 Save as template
    Filters                                                                                should this live in                                   Save to dashboard
                                                                                           search or reports? or
    Format                                                                                 should there be an                                    Create report
                                                                                           interactive charting
    CHART TYPES         TABLE
                                                                                           section that holds the
                                                                                           content pieces/
                                                                                           visualizations/
    DISTRIBUTION            RELATIONSHIPS    COMPARISON         TRENDS                     projections

                                                                                           - make sure I
    Format                                                                                 understand that table
                                                                      [ Edit title ]
                                                                                           thing.
                                                                                                                                                   COLOR




                                                paste search string here




                                Review / refine search


        x-axis TIME             y-axis EVENTS - sum

Splunk | Reporting - Concepts 1

  • 1.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports | | Alerts | | Visualizations | | Application Settings Reports search for report Name Last Modified Dashboards Type Preview Events by time March 3, 2008, 11:45 - 154kb Ports by firewall March 4, 2008, 11:45 Main 124kb Application Configuration Change Report March 5, 2008, 11:45 Change Mgmt, Main 54kb example2.jpg March 4, 2008, 11:45 - 124kb Events by time March 3, 2008, 11:45 - 154kb Ports by firewall March 4, 2008, 11:45 Main 124kb Application Configuration Change Report March 5, 2008, 11:45 Change Mgmt, Main 54kb example2.jpg March 4, 2008, 11:45 - 124kb Assign Permissions Delete Report Add Report view, modify, clone report template vs. report content data source(s) / summarized results / static report OR saved search / variable report last run, availabloe versions / historical? frequency - does it have a sched charts
  • 2.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports | | Alerts | | Visualizations | | Application Settings } Create Report search for report Clone existing report select report template Pick format Next Step Pick what you're trying to show
  • 3.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports | | Alerts | | Visualizations | | Application Settings < Reports Main New Report HEADER click to edit CONTENT 1 Actions / Preferences Step 1 of 2: Specify Data Set Use Saved Search New Search select saved search Open search template in new window Review / refine search paste search string here Step 2 of 2: Format Content > + Add Content
  • 4.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports | | Alerts | | Visualizations | | Application Settings < Reports Main New Report HEADER click to edit CONTENT 1 Actions / Preferences Step 1 of 2: Specify Data Set Use Saved Search New Search select saved search Open search template in new window paste search string here Step 2 of 2: Format Content > Review / refine search + Add Content
  • 5.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports | | Alerts | | Visualizations | | Application Settings < Reports Main < Back to search New Report + Add Content Header Content Title [ Actions / Preferences ] FORMAT Data Set Move up | Move down Format Half width | Full width CHART TYPES TABLE SAVE Save Content DISTRIBUTION RELATIONSHIPS COMPARISON TRENDS Save to Dashboard Format [ Edit title ] COLOR paste search string here Review / refine search x-axis TIME y-axis EVENTS - sum
  • 6.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports | | Alerts | | Visualizations | | Application Settings Timeframe: Last 24 hours IP Address=Foo | Host=Bar > Search assistance Save Search | Save as Alert | Export Results analyze / chart results
  • 7.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports / Charts | | Alerts | | Visualizations | | Application Settings [ < Back to search / data set ] Chart / Graph Results generated: 08/09/08: 09:00 I want to Table only CHART distribution trends relationships comparison table / chart fields x-axis primary column Select Field y-axis secondary column(s) Select Field compare relationships? of a single or multiple field over time compare values for a single or multiple field over time
  • 8.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports / Charts | | Alerts | | Visualizations | | Application Settings [ < Back to search / data set ] Chart / Graph Results generated: 08/09/08: 09:00 I want to Table only CHART distribution trends relationships comparison OVER TIME distribution of single field over time table / chart fields compare distribution of fields over time ?? x-axis primary column Select Field distribution of field vs. another field y-axis secondary column(s) Select Field
  • 9.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports / Charts | | Alerts | | Visualizations | | Application Settings [ < Back to search / data set ] Chart / Graph Results generated: 08/09/08: 09:00 Table only CHART distribution trends relationships comparison table / chart fields x-axis primary column Select Field y-axis secondary column(s) Select Field compare relationships? of a single or multiple field over time compare values for a single or multiple field over time
  • 10.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports / Charts | | Alerts | | Visualizations | | Application Settings [ < Back to search / data set ] Chart / Graph Results generated: 08/09/08: 09:00 I want to Table only CHART distribution trends relationships comparison table / chart fields x-axis primary column Time Binning options... y-axis secondary column(s) Field1 fn: sum Modify...
  • 11.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports / Charts | | Alerts | | Visualizations | | Application Settings [ < Back to search / data set ] Chart / Graph Results generated: 08/09/08: 09:00 I want to Table only CHART distribution trends relationships comparison table / chart fields x-axis primary column Time Binning options... y-axis secondary column(s) Field1 fn: sum Modify...
  • 12.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports | | Alerts | | Visualizations | | Application Settings < Back to search [ Data set ] generated: 08/09/08: 09:00 Chart / Graph Results Display primary results as: TABLE CHART Show table TRENDS RELATIONSHIPS USE WHEN DISTRIBUTION COMPARISON area graphs—like line graphs—are more suitable for displaying Histogram Bar Area Pie Donut Scatter Bubble Line Heat map continuous data I want to see: Field name [ All Fields... ] fn Field name [ All Fields... ] y-axis events count BY x-axis time Split by [ Binning Options... ] Field name [ All Fields... ] Display as Add series 2 scales for y series ?? axis Filters: Results presentation: [ Actions ] [ Edit title ] based on data generated: 08/09/08: 09:00 COLOR
  • 13.
    RELATIONSHIPS Heat map A heatmap is a graphical representation of data where the values taken by a variable in a two- dimensional map are represented as colors >
  • 14.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports | | Alerts | | Visualizations | | Application Settings < Back to search [ Data set ] Chart / Graph Results [ Actions / Preferences ] Save as template Display results as: Save to dashboard TABLE CHART Create report Filters Format [ Edit title ] COLOR paste search string here should this live in Review / refine search search or reports? or should there be an interactive charting x-axis TIME y-axis EVENTS - sum section that holds the content pieces/ visualizations/ projections - make sure I understand that table thing.
  • 15.
    Display results as: TRENDS Line Line DISTRIBUTION COMPARISON RELATIONSHIPS Histogram Bar Chart Pie chart Donut Scatter Bubblle Heat map z-axis is x axis is * Category groups, series Bubble graphs are like A heat map is a graphical continuous categorical groups, and values series as scatter graphs, with a representation of data where the values (e.g.. time) doughnut slices third variable size. They taken by a variable in a two- let you chart three dimensional map are represented as * Typically shows percentage variables in two colors dimensions. >
  • 16.
    | | Logged in as Username | Logout | Admin | Jobs (3) | Help Dashboards | | Search | | Reports | | Alerts | | Visualizations | | Application Settings Search [ Data set ] Timeframe: Last 24 hours IP Address=Foo | Host=Bar > Search assistance Chart / Graph Results [ Actions / Preferences ] Save as template Filters should this live in Save to dashboard search or reports? or Format should there be an Create report interactive charting CHART TYPES TABLE section that holds the content pieces/ visualizations/ DISTRIBUTION RELATIONSHIPS COMPARISON TRENDS projections - make sure I Format understand that table [ Edit title ] thing. COLOR paste search string here Review / refine search x-axis TIME y-axis EVENTS - sum