Creating a tabular chart

Use a tabular chart when you have more than one set of values that have a direct relationship.

1. In the Views section of the widget, give the chart a name and select whether to show the title and the update status.
2. Select Tabular Display.
3. On the General tab, set the following properties:
   1. Select all columns or specify which columns to display.
   2. If you selected specific columns, click More options for each column and give the column a name to display. You can also set the following options: specify the column alignment or use the alignment that is inherited from the default column settings; specify the data format as none (no formatting is applied), date, date and time, or number (the latter formats use the locale default formatting); specify the column width either in pixels or as a percentage of the width of the chart.
   3. Select the default alignment for all of the columns in the table.
   4. Select a table size and the maximum number of items to display.
4. On the Thresholds tab, set thresholds to display conditional color formatting in the chart.
   1. Click Add Threshold Indicator.
   2. Set thresholds to display any numerical field in the query, such as the magnitude of events. Select the threshold indicator (color, shape, or both) and then select the column.
   3. If you selected color, enter a value and then click Add Value to pick a color or enter an HTML color code in the color palette to make it easier to select the same colors on different charts.
   4. If you selected shape, enter a value and then click Add Value to pick a shape.
      If you select color and shape threshold indicators, color is applied to the shape instead of the left border of the table. For example, a caution state can be displayed as a yellow triangle. You can use the same threshold values for color and shape.
      Run the query to get results and check your threshold settings to make sure that they work properly. It is invalid to select a non-numerical column as a threshold.
5. Optional: On the Drilldown tab, choose an action for when a row is clicked in the tabular chart. You can open a dashboard, a URL, or a specific page in the source application (IBM QRadar or QRadar Analyst Workflow).
   1. If you chose to open a dashboard, select the dashboard to open, optionally select dashboard parameter values, and choose whether to open it in the current window or in a new window.

      If you set parameters, they are passed to the target dashboard based on the row that was clicked in the tabular chart. For example, if you set an ID parameter, the bar or segment ID is passed as a parameter to the target dashboard. If you set a dashboard parameter value to Default, no parameter value is passed to the target dashboard; the existing session or default parameter value is used or the parameter field is blank in the target dashboard Parameters card.

      Tip: If you drill down to a different dashboard in the same window, you can use the breadcrumb trail to return to previous dashboards in the drill path.
   2. If you chose to open a URL, specify an absolute path to open an external URL (for example, https://www.ibm.com) or a relative path to open a QRadar page, such as DNS lookup. The URL opens in a new browser window.

      You can define any number of parameters anywhere in the URL. Enclose parameters in braces ({}), then select a value for each parameter.

      The following table lists some typical QRadar URLs with parameters:

      Description	URL
      QRadar port scan The data source must include source or destination IP addresses. The {ip_address} string defines an ip_address URL parameter for a source or destination IP address column. Then, when you drill down on a table row, the port scan page opens to the source or destination IP address of the row.	/console/core/jsp/investigate.jsp?type=port_scan&host={ip_address}
      QRadar DNS lookup The data source must include source or destination IP addresses. The {ip_address} string defines an ip_address URL parameter for a source or destination IP address column. Then, when you drill down on a table row, the DNS lookup page opens to the source or destination IP address of the row.	/console/core/jsp/investigate.jsp?type=dns_lookup&host={ip_address}
      QRadar WHOIS lookup The data source must include source or destination IP addresses. The {ip_address} string defines an ip_address URL parameter for a source or destination IP address column. Then, when you drill down on a table row, the WHOIS lookup page opens to the source or destination IP address of the row.	/console/core/jsp/investigate.jsp?type=whois_lookup&host={ip_address}
      QRadar Offense Summary page The data source must include offense IDs. The {offense_id} string defines an offense_id URL parameter for an ID column. Then, when you drill down on a table row, the Offense Summary page opens to the offense ID of the row.	/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId={offense_id}

6. Preview how the chart looks and then click Save.
   Tip: The labels for the chart come from the queries that are used. If they are unintelligible in the preview, edit the labels in the View section.