Using Live Dashboards

This page explains the key components of live dashboards, as well as their applications and uses.

Setting up the timeframe and time granularity

Use the timeframe picker in the top-right corner of the Dashboards page to set up the timeframes that apply to all dashboard widgets (updating the corresponding NQL query).

Use one of the predefined timeframes, ranging from Last hour to Last year, or select a custom timeframe. For Custom timeframes, the maximum lookback and maximum selected duration is 395 days.

Depending on the selected timeframe, you can set time granularity to By 15 min, By hour, By day, By week or By month to identify patterns and troubleshoot issues. Changes in time granularity only update line charts.

Refer to the Timeframe picker documentation for details on how the system implements the timeframe picker in the NQL queries for dashboards.

Filtering dashboards

Filters appear at the top of the Dashboard page, allowing you to filter dashboards by platform, device, location, hardware and other configured parameters.

Refer to the Managing Live Dashboards documentation to add, manage and customize filters.

Refer to the Filter widget documentation to learn how the system implements filters in NQL queries for dashboards.

Click on the elements of the bar charts to apply filters to the page. This action defines the scope by filtering the targeted objects with a condition on a property.

Using dashboard widgets

Refer to the Managing Live Dashboards documentation to add, manage and customize widgets.

Right-click on any dashboard widget item or value to access the following options:

View investigation opens the Investigations page for the original NQL of the widget plus any applied filters to the Dashboard page, the time duration and granularity.
Drill down to … opens the Investigation page with the results of the NQL query listing items from one of the following alternatives:
- The root table of the original query, for example, execution.crashes.
- The associated object tables, for example, binaries or devices.
The NQL query from the drill-down retains the context of the original query. The Drill down to... option is available for the KPI widget, Bar chart and Table items.
For KPI and Table-type widgets, the contextual action menu allows you to:
- Copy value or Copy raw value. The system shortens large numbers with appropriate suffixes. Hover over a metric to see the raw number.
For Table-type widgets only, the contextual action menu allows you to:
- Open binary profiling or Open Device View, depending on the case.
  - Hover over the names of binaries displayed in the table-type widget to obtain an AI-generated binary description.
- Diagnose issues using dashboards from the Alerts and Diagnostics module.
- Retrieve all pre-filled investigation queries in a device or binary context.

You can obtain binary contextual descriptions directly by hovering binary names in the table-type widget.

The examples below describe how the system updates the corresponding investigation queries with the changes made from the Dashboards page.

Example of viewing an investigation from a dashboard

View investigation of a KPI dashboard widget showing the number of devices with crashes over the past 1 day.

The original NQL of the KPI is:

devices
| with execution.crashes during past 1d
| summarize devices = count()

Apply the following filters to the dashboard:

Last hour from the timeframe picker.
Mac from the OS filter.

The Investigations page shows results using a modified NQL query:

devices during past 60min 
| where device.operating_system.platform == macOS 
| with execution.crashes during past 60min 
| where device.operating_system.platform == macOS 
| summarize devices = count()

The modified query on the Investigations page includes:

The filter modification |where device.operating_system.platform == macOS
The timeframe picker modification during past 60min

Example of drilling down to an investigation from a dashboard

Drill down… on a KPI dashboard widget showing the number of devices with crashes over the past 1 day.

The original NQL of the KPI is:

devices
| with execution.crashes during past 1d
| summarize devices = count()

Apply the following filters to the dashboard:

Last hour from the timeframe picker
Mac from the OS filter

The Investigations page shows results using a modified NQL query:

devices during past 60min 
| where device.operating_system.platform == macOS 
| include execution.crashes during past 60min 
| where device.operating_system.platform == macOS 
| compute number_of_events_ = crash.number_of_crashes.sum() 
| where number_of_events_ != 0 
| list 
  device.name, 
  device.entity, 
  device.hardware.model, 
  device.hardware.type, 
  device.operating_system.name

The modified query on the Investigations page includes:

The filter modification where device.operating_system.platform == macOS
The timeframe picker modification during past 60min
Transformation of the summarize line into the list line

The fields that the list line returns are:

Default fields of the root table, for example, the table that you reference in the first line of the query
If you do an aggregation on a particular field, it returns that specific field: summarize num_freezes = execution.event.number_of_freezes.sum() is transformed to list [default fields], execution.event.number_of_freezes

From the Investigation page, you can use the action bar on the Investigations page to perform additional operations and drill-downs.

Refer to the Investigate option in the action bar section in the investigation NQL editor documentation for more information about investigation drill-downs.

Opening Device View from a dashboard widget value.

Editing and exporting a dashboard

Click on the action menu in the top-right corner of the Dashboards page to Edit and Export live dashboards.

You may Duplicate or Delete a dashboard using the same action menu from the Dashboard page.

Refer to the Managing Live Dashboards documentation to learn how to create, manage and customize live dashboards.

Sharing a dashboard URL

You can copy the URL of your dashboard and share it with other users. However, recipients must have Live Dashboards access to successfully open the URL.

A dashboard URL contains:

Selected timeframe
Selected filters and their values
Currently selected tab

The recipients load the dashboard in the same state as you intended them to see it.

Refer to Managing Live Dashboards documentation to learn more about sharing dashboards and grating permissions.