Using Live Dashboards

This page explains the key components of live dashboards, as well as their applications and uses.

Setting up the timeframe and time granularity

Use the timeframe picker in the top-right corner of the Dashboards page to set up the timeframes that apply to all dashboard widgets (updating the corresponding NQL query).

Use one of the predefined timeframes, ranging from Last hour to Last year, or select a custom timeframe. For Custom timeframes, the maximum lookback and maximum selected duration is 395 days.

Depending on the selected timeframe, you can set time granularity to By 15 min, By hour, By day, By week or By month to identify patterns and troubleshoot issues. Changes in time granularity only update line charts.

Refer to the Timeframe picker documentation for details on how the system implements the timeframe picker in the NQL queries for dashboards.

Filtering dashboards

Filters appear at the top of the Dashboard page, allowing you to filter dashboards by platform, device, location, hardware and other configured parameters.

Refer to the Managing Live Dashboards documentation to add, manage and customize filters.

Refer to the Filter widget documentation to learn how the system implements filters in NQL queries for dashboards.

Click on the elements of the bar charts to apply filters to the page. This action defines the scope by filtering the targeted objects with a condition on a property.

Using dashboard widgets

Refer to the Managing Live Dashboards documentation to add, manage and customize widgets.

Right-click on any item or value within a dashboard widget to access a set of options. The available options depend on both the widget type and the data type of the selected item.

View investigation opens the Investigations page for the original NQL of the widget plus any applied filters to the Dashboard page, the time duration and granularity.
Drill down to … opens the Investigation page with the results of the NQL query listing items from one of the following alternatives:
- The root table of the original query, for example, execution.crashes.
- The associated object tables, for example, binaries or devices.
The NQL query from the drill-down retains the context of the original query.
Copy copies the formatted value visible on the widget, including the units, for example 1m 26s, 306 GB or 32.5%.
Copy raw value copies the full underlying value, for example:
- 1m 26s is copied as 86.42345139288133 (total seconds)
- 306GB is copied as 328676378256 (bytes)
- 32.5% is copied as 0.325057090224 (decimal form)
For inventory objects, such as users, devices and binaries:
- Open Device View, Open user overview, depending on the case.
- Diagnose issues using dashboards from the Alerts and Diagnostics module.
- Retrieve all pre-filled investigation queries in a device or binary context.

Opening Device View from a dashboard widget value.

You can obtain binary contextual descriptions directly by hovering binary names in the table-type widget.

The examples below describe how the system updates the corresponding investigation queries with the changes made from the Dashboards page.

Example of viewing an investigation from a dashboard

View investigation of a KPI dashboard widget showing the number of devices with crashes over the past 1 day.

The original NQL of the KPI is:

devices
| with execution.crashes during past 1d
| summarize devices = count()

Apply the following filters to the dashboard:

Last hour from the timeframe picker.
Mac from the OS filter.

The Investigations page shows results using a modified NQL query:

devices during past 60min 
| where device.operating_system.platform == macOS 
| with execution.crashes during past 60min 
| where device.operating_system.platform == macOS 
| summarize devices = count()

The modified query on the Investigations page includes:

The filter modification |where device.operating_system.platform == macOS
The timeframe picker modification during past 60min

Example of drilling down to an investigation from a dashboard

Drill down… on a KPI dashboard widget showing the number of devices with crashes over the past 1 day.

The original NQL of the KPI is:

devices
| with execution.crashes during past 1d
| summarize devices = count()

Apply the following filters to the dashboard:

Last hour from the timeframe picker
Mac from the OS filter

The Investigations page shows results using a modified NQL query:

devices during past 60min 
| where device.operating_system.platform == macOS 
| include execution.crashes during past 60min 
| where device.operating_system.platform == macOS 
| compute number_of_events_ = crash.number_of_crashes.sum() 
| where number_of_events_ != 0 
| list 
  device.name, 
  device.entity, 
  device.hardware.model, 
  device.hardware.type, 
  device.operating_system.name

The modified query on the Investigations page includes:

The filter modification where device.operating_system.platform == macOS
The timeframe picker modification during past 60min
Transformation of the summarize line into the list line

The fields that the list line returns are:

Default fields of the root table, for example, the table that you reference in the first line of the query
If you do an aggregation on a particular field, it returns that specific field: summarize num_freezes = execution.event.number_of_freezes.sum() is transformed to list [default fields], execution.event.number_of_freezes

From the Investigation page, you can use the action bar on the Investigations page to perform additional operations and drill-downs.

Refer to the Investigate option in the action bar section in the investigation NQL editor documentation for more information about investigation drill-downs.

Editing and exporting a dashboard

Click on the action menu in the top-right corner of the Dashboards page to Edit and Export live dashboards.

You may Duplicate or Delete a dashboard using the same action menu from the Dashboard page.

Refer to the Managing Live Dashboards documentation to learn how to create, manage and customize live dashboards.

Sharing a dashboard URL

You can copy the URL of your dashboard and share it with other users. However, recipients must have Live Dashboards access to successfully open the URL.

A dashboard URL contains:

Selected timeframe
Selected filters and their values
Currently selected tab

The recipients load the dashboard in the same state as you intended them to see it.

Refer to Managing Live Dashboards documentation to learn more about sharing dashboards and grating permissions.