Dashboard Widgets

A widget is one chart, number or table on a dashboard. You build it in the widget editor by answering a few questions: which data, which records, and how to break them down. UTMStack v12 writes the query for you; widgets have no SQL.

Before you start

• You need the dashboards.write permission (Administrator and Analyst roles).

• Widgets can only be added to dashboards you created or copied. Shipped dashboards cannot be changed.

• A widget belongs to one dashboard. It is saved as soon as you click Save widget.

Add a widget

1. 1

   Open the dashboard in edit mode

   Open the dashboard and click Edit (the pencil), then Add widget.

2. 2

   Pick a chart type

   The Pick a chart type dialog opens. Choose one of the types in the table below and click Continue. You can change the type later.

   
3. 3

   Answer the questions

   The New widget page opens with the questions on the left and a live Chart preview on the right. Fill them in as described in Build the widget below.

4. 4

   Save

   Click Save widget. You return to the dashboard, still in edit mode. Move or resize the new widget if needed, then click Save in the edit bar.

Chart types

Every chart type counts records. A widget cannot add up, average or count distinct values of a field.

Build the widget

Title

Optional. Without a title, the widget is named after its chart type.

Which data?

Choose the Data set: logs or alerts. Until you choose one, conditions and grouping are disabled ("Choose a data set to enable conditions and grouping.").

Include only events where…

Add conditions to narrow the records. Click Add condition, then pick a Field, an Operator and a Value. With no conditions, "all events in the time range are included". All conditions must match.

How each operator compares values is described on Filter Operators Reference. In UTMStack v12.0.2, is greater than, is less than or equals and is between do not work on fields inside origin, target or log: use them only on top-level number fields. For time, rely on the dashboard's time range instead of a condition.

Break down by

Bar, Line, Area and Pie charts, and Table, ask how to split the count:

How many sets the number of values (or lines) shown. The default is 50.

For Table, this section is called Top values table. Top values gives one row per value with its count. Over time instead lists records with the Columns you choose.

Only fields with a single value per record can be used to group: not whole objects such as origin, not lists and not the original log line.

Columns

For Table (with Over time), List, Coordinate map and Text, the widget shows records, newest first. Under Columns, click Add a column… to choose the fields to show. With no columns, every field of the record is shown. How many sets the number of records (default 50).

The column header shows the last part of the field name (country for origin.geolocation.country), unless two columns would end the same way.

Coordinate map

A coordinate map needs a latitude and a longitude for each record. Add the two geolocation fields of one side as columns, for example origin.geolocation.latitude and origin.geolocation.longitude. Add origin.geolocation.city or origin.ip as a third column to label the markers. Records without a valid position are skipped ("No points with valid lat/lon.").

The map background is loaded from OpenStreetMap, so the browser needs internet access to show it. The geolocation fields are written by pipelines that use geolocation enrichment; see Geolocation Enrichment.

Change a widget

1. Open the dashboard and click Edit.

2. Use the widget's edit button. The Edit widget page opens.

3. To switch chart type, click the Chart: chip next to the title, pick a type and click Apply.

4. Change the answers and click Save widget.

Remove a widget

In edit mode, use the widget's remove button, then click Save. Confirm "Delete this widget? This cannot be undone." The widget is deleted for good.

Limits

When a widget cannot load, it shows "Could not load widget data." with the reason and a retry button.