Creating a time series chart
Time series charts illustrate data points at successive intervals of time. You use a time series chart to show trending or comparisons.
Complete the following task: Creating widgets from an AQL data source. Ensure that you have query results.
Before you begin
- In the Views section of the widget, give the chart a name and select whether to show the title and the update status.
- Select Time Series Chart.
- On the General tab, set the following properties:
- Select the time for the x-axis to display.
- Optional: Select the dynamic series option to split the time series by a specific data point. This option helps make the data more visually consumable, and makes it easier to create a time series chart. For more information, see Time series charts in QRadar Pulse and Tracking the top five most active devices in the last ten minutes.
- Select a field for the y-axis and a color for the display. Optionally, click
Add Series to plot more than one series. Tip: For best results in time series area charts that are not stacked, order the y-axis fields from smallest to largest on the General tab. Ordering the fields prevents larger values from overlapping smaller values.
- Optional: Set Area Chart to On to fill the area below the plotted line with color.
- Optional: If you use an area chart with more than one y-axis series, set Stacked Area Chart to On to sum and stack the series on top of each other.
- Set Show Legend to Yes and set the orientation.
- On the Axes tab, set the Y Axis Type based
on the data that is retrieved from the query. The following table describes the available axis
Type Description None The chart attempts to automatically determine the type based on the data set. Linear Numeric axis mode. Displays a range of numbers. Bars display as unique numerical values for each selected field, and are spaced in a linear manner according to their values. Log Numeric axis mode. Bars display as unique numerical values, and are spaced in a logarithmic manner according to their values.
- Optional: Turn on value axis range to set a minimum and maximum for the value axis, and then click Save.
- Optional: On the Thresholds tab,
set threshold lines so that you can quickly recognize when values exceed predefined benchmarks, such
as low, medium, high, and critical.
- Enter a name for the line and a value, and then click Add Value.
- Pick a color or enter an HTML color code in the color palette. You can use the same
color code in multiple charts, which helps make threshold displays consistent in meaning across all
of your charts. For example, Critical has a value of 10 and is burgundy in color. The name Critical appears when you hover over the line in the chart.
Preview how the chart looks and then click Save.
Tip: The labels for the chart come from the queries that are used. If they are unintelligible in the preview, edit the labels in the View section.
The following image shows the top 10 most active devices in the last ten minutes.