Line chart
Description
Line charts facilitate the viewing of trends over time.
The NQL query must include a timestamp field and one or more aggregations.
Data shape
<timestamp>, <kpi1>, <kpi2>, …
NQL structure
Aggregated KPI over time
<event table> <time_duration>
...
summarize <kpi1>, <kpi2>, ... by <time_duration_granularity>
(list <time>, <kpi1>, <kpi2>, ...)
The list line is optional. If you don’t specify the list line, the system uses start_time by default. If you would like to use a different time field, for example end_time, you can use the list line to specify this.
Series names
Series names come from their corresponding variable names in the NQL query.
The variable names are formatted with the following heuristic:
Underscores are replaced with spaces.
The first character of the variable is changed to upper-case.
NQL examples
Refer to the Live Dashboards NQL examples documentation for more information.
Line chart specific settings
Widget description (Optional): Enter an optional text description to explain, for example, how the metric should be interpreted, how it is calculated, or any subtleties to the metric. The title is required before the description can be entered. After you enter the description and press done, an info icon appears next to the title in the dashboard. When you hover over the icon, the information you have entered appears as an info tip.
Rating: Shade portions of the line chart in red or yellow to enable the viewer to more quickly assess whether the data is indicating an issue. Choose from:
1 threshold: The line chart shows a red section to indicate a bad range.
2 thresholds: the line chart shows a red section to indicate a bad range and a yellow section to indicate an average range.
Multiple metrics
Nexthink does not recommend mixing metrics with different units on the same line chart, since a secondary y-axis is not yet supported. If you choose to mix metrics of different units in the same line chart, note that the unit of measure is dictated by the order of the metric in the query:
The y-axis displays the unit of the first metric in the query.
The maximum value depends on the maximum value of all series, i.e., it may take the maximum value from the second series even though they are different units.
Examples
execution.events during past 7d
| where binary.name == "outlook.exe"
| summarize memory__ = memory.avg() , execution_duration__ = execution_duration.sum() by 1d
The system takes the unit from memory__, which is a bytes field. To obtain the maximum value for the y-axis, the system compares the maximum value of the memory__ series, which is 262MB (274 million bytes), to the maximum value of execution_duration__, which is 13 weeks (7 million seconds). The system uses the value of 262MB.
execution.events during past 7d
| where binary.name == "outlook.exe"
| summarize execution_duration__ = execution_duration.sum(), memory__ = memory.avg() by 1d
The system takes the unit from execution_duration__, which is a duration field. To obtain the maximum value for the y-axis, the system compares the maximum value of the memory__ series, which is 262MB (274 million bytes), to the maximum value of execution_duration__, which is 13 weeks (7 million seconds). The system uses the value of 274 million and treats it as seconds (274 million seconds = 454 weeks, 4 days).
RELATED TOPICS