Creating a scatter chart

Use scatter charts to explore correlations between different measures. Scatter charts use data points to plot two measures anywhere along a scale.

Before you begin

Complete one of the following tasks: Creating widgets from an offense data source or Creating widgets from an AQL data source. Ensure that you have query results.

Procedure

  1. In the Views section of the widget, give the chart a name and select whether to show the title and the update status.
  2. Select Scatter Chart.
  3. On the General tab, set the following properties:
    1. Select a field for the x-axis.
    2. Optional: Select Dynamic Series to subdivide the x-axis field by another field. By using a dynamic series, you can compare subdivisions within the x-axis field.
      Restriction: To prevent performance degradation, QRadar Pulse renders the first 20 data series that it detects, and ignores subsequent series. You can limit the size of the data by using the AQL WHERE clause to LIMIT and ORDER your data sets for use in a dynamic series.
    3. Select a field for the y-axis and specify the axis label, line mode, and symbol shape and size for data points in the scatter chart.
    4. Set Show Legend to Yes and set the orientation.
  4. On the Axes tab, set the Y Axis Type based on the data that is retrieved from the query. The following table describes the available axis types:
    Type Description
    None The chart attempts to automatically determine the type based on the data set.
    Linear Numeric axis mode. Displays a range of numbers. Each bar represents a unique numerical value for each selected field, and bars are spaced in a linear manner according to their values.
    Log Numeric axis mode. Bars display as unique numerical values, and are spaced in a logarithmic manner according to their values.
  5. Set the Value Axis Range to Yes and enter Minimum and Maximum values to make it easier to compare data in different charts.
  6. On the Thresholds tab, set thresholds for the scatter chart. Thresholds can be indicated in various ways in the chart.
    1. Click Add Threshold Indicator.
    2. Set thresholds to display any numerical field in the query, such as the magnitude of events. Select the threshold indicator (point color, point shape, point size) and then select the column.
    3. Enter a value and click Add Value to pick a color or enter an HTML color code in the color palette to make it easier to select the same colors on different charts.
      It is invalid to select a non-numerical column as a threshold. Run the query to get results and check your threshold settings to make sure that they work properly.
  7. Preview how the chart looks and then click Save.

Results

The following image shows a scatter chart to display events by unique ID:

Scatter chart