Adding a dashboard

Add a dashboard to display your IBM® Security QRadar® Suite KQL query results. You can add panels to your dashboard to display the results of multiple queries.

1. In your Grafana instance, from the navigation menu, click Dashboards.
2. On the Dashboards page, click New > New Dashboard, and then click Add visualization.
3. On the Query tab, in the Data source field, select QRadar Suite KQL Plugin.
   Tip: You can add a dashboard panel that queries two or more data sources. To query more than one data source, select Mixed.
4. Enter your KQL query.
   The following time picker macro is supported:

   • $__timeFilter()

   You can include the time picker macros in a KQL query  WHERE  condition. See the following example query:

   events
   | project original_time,src_ip
   |  where $__timeFilter(original_time) 
   | summarize Events=dcount(src_ip) 

   Important: You must use a  time  value in your KQL query for time series visualization. See the following example query:

   events
   | project original_time, severity
   | where $__timeFilter(original_time)
   | summarize by time=bin(original_time,.005),severity

5. Click Run Query.
6. Optional: In the Title field, enter a name for your panel.
7. Optional: Configure the parameters for your panel.
8. To apply your panel changes and return to the Dashboard page, click Apply.
   Important: Applying your changes does not save your dashboard.
   • To add another panel to your dashboard from the Dashboard page, click the Add panel icon ().
   • To save your changes from the Dashboard page, click the Save icon ().
9. To save your dashboard, click Save.
10. In the Save dashboard panel, enter a name for your dashboard.
11. In the Folder field, select a folder or enter a name to create a new folder, and then click Save.
    A Dashboard saved message is displayed. Your dashboard is saved on the Dashboard page in the folder that you chose.
12. To edit your dashboard, follow these steps:
    1. On the Dashboards page, click the relevant dashboard.
    2. On the panel that you want to edit, click the Menu icon (), and then click Edit.
    3. Edit your dashboard, and then click Save.
    4. In the Save dashboard panel, enter a description of your changes, and then click Save.
13. To delete your dashboard, follow these steps:
    1. On the Dashboards page, click your dashboard and then click the Dashboard settings icon ().
    2. Click Delete Dashboard.
    3. In the Delete window, click Delete.