• Services & Support
  • Devo.com
  • Contact
    • Contact Us
    • Request a Demo
    • Partner Inquiry
  • Log In
    • USA Devo
    • EU Devo
  • The Devo data operations platform
    • Deployment models
    • How Devo works
    • Key concepts
  • Getting started
    • Sign up and log in
    • Navigating the Devo app
    • User preferences
    • Devo video tutorials
  • Domain administration
    • Users and roles
      • Managing users
      • Monitoring user activity
      • Managing roles
    • User authentication
      • Multi-factor authentication
      • SAML
        • Google as an identity provider
        • Okta as an identity provider
        • OneLogin as an identity provider
    • Security credentials
    • Data processes and feeds
    • Domain preferences
  • Sending data to Devo
    • The Devo In-House Relay
      • Installing the Devo Relay
        • Install on a virtual machine
        • Install on an Ubuntu box
        • Install on a Unix-like box
      • Configuring the in-house relay
        • Customizing in-house relay settings
        • Defining relay rules
        • Managing the relay on the command line
        • Setting up high-availability
      • Relay troubleshooting tips
    • Event sources
      • Unix-like machines
        • Configuration packages for *nix
          • Ubuntu and Debian
          • Fedora and RHEL
          • CentOS V5-6
        • syslog configuration
          • rsyslog
            • Simple sending using rsyslog
            • Secure sending using rsyslog
            • Monitoring files using rsyslog
          • syslog-ng
            • Simple sending using syslog-ng
            • Secure sending using syslog-ng
            • Monitoring files using syslog-ng
          • syslog
          • SELinux configuration conflicts
      • Windows
        • Devo Agent for Windows
        • Snare Agent for Windows
        • Configuring WMI for Devo file monitoring
      • MacOS X
      • Cloud services
        • AWS S3 Buckets
        • Microsoft Azure
      • Commercial products
      • Custom apps
        • Java apps
          • JDK java.util.logging
          • Scoja client library
        • Node.js apps
        • Python apps
        • Sample code
    • Other data collection methods
      • HTTP endpoint
      • Logstash
    • Uploading log files
  • Supported technologies
    • About Devo tags
    • List of supported technologies
      • Antivirus
        • av.mcafee
      • Box (PC/Server)
        • box.iptables
        • box.stat
        • box.unix
        • box.vmware
        • box.win
      • Firewall
        • firewall.checkpoint
        • firewall.cisco
        • firewall.fortinet
        • firewall.huawei
        • firewall.juniper
        • firewall.meraki
        • firewall.paloalto
        • firewall.pfsense
        • firewall.sonicwall
        • firewall.sophos
        • firewall.stonegate
        • firewall.windows
      • Network
        • netstat.netflow
        • switch.cisco
      • Proxy
        • proxy.bluecoat
        • proxy.squid
      • Web
        • web.apache
        • web.apache.mod-security
        • web.iis
        • web.jboss
        • web.nginx
        • web.tomcat
      • Other technologies
        • db.mysql
        • dns.bind
        • my.app
        • social.salesforce
        • test.drop
        • test.keep
        • uba.varonis
        • unknown.unknown
  • Querying your data
    • Accessing data tables
      • Run a search using a finder
        • Use the default finder
        • Use a custom finder
          • Create a custom finder
          • Assign a custom finder to a role
          • Edit a custom finder
        • Use the aliased finder
          • Add a query to your aliased finder
      • Run a global search
      • Run a LINQ free text query
    • Working in the query window
      • Setting up a data table
        • Modifying the column layout
          • Arrange and resize columns
          • Hide and show columns
          • Change the position of column headers
          • Sort data
          • Setting a default table layout
        • Add a description to a data table
      • Building a query
        • Build a query using the query window tools
          • Filter data
            • Order group (filter)
            • String group (filter)
            • General group (filter)
            • Name group (filter)
            • Network group (filter)
            • Logic group (filter)
            • Web group (filter)
          • Group data
          • Aggregate data
            • Aggregation operations
          • Create columns
            • Order group
            • Arithmetic group
            • String group
            • General group
            • Date group
            • Name group
            • Network group
            • Geolocation group
            • Logic group
            • Flow group
            • Web group
            • Mathematical group
            • Conversion group
            • Cryptography group
            • Packet group
              • Ethernet operations
              • IPv4 operations
              • TCP operations
              • UDP operations
        • Build a query using LINQ
          • Filter data using LINQ
          • Group data using LINQ
          • Aggregate data using LINQ
          • Create new columns using LINQ
          • LINQ query examples
      • Generate charts
        • Affinity chord diagram
        • Availability timeline
        • Bipartite chord diagram
        • Bubble chart
        • Chart aggregation
        • Custom date chart aggregation
        • Flame graph
        • Flat world map by coordinates
        • Flat world map by country
        • Google animated heat map
        • Google area map
        • Google heat map
        • Graph diagram
          • Creating a graph diagram
          • Graph diagram menu
          • Monitor intranet traffic to dangerous websites
        • Histogram
        • Pie chart
        • Pie layered chart
        • Punch card
        • Sankey diagram
        • Scatter plot
        • Time heatmap
        • Voronoi treemap
      • Data enrichment
        • Upload a lookup table
        • Add lookup values to a data table
        • Manage lookup tables
        • Dynamic lookups
        • Threat lookups
      • Advanced data operations
        • Graphical correlation
          • Cross-Search Graph Diagram
          • Cross-Search Table Join
          • Cross-Search Sankey Diagram
          • Cross-Search Line Chart
        • Custom tables
          • Create a custom table
          • Merge a custom table with a query
          • Edit custom tables
        • Inject data to a new table
    • Managing your queries
      • Rename a query
      • Favorite queries
      • Last accessed queries
      • Check currently running queries
      • Add a description to your query
      • Block a query
      • Download a query
      • Close a query
    • Best practices for data search
  • Dashboards
    • Setup a data source
    • Create a new dashboard
    • Working with dashboard widgets
      • Availability timeline widget
      • Chord diagram widget
      • Circle world map widget
      • Color key value widget
      • Color world map widget
      • Column chart widget
      • Comparative chart widget
      • Funnel widget
      • Gauge meter widget
      • Google heatmap widget
      • Heat calendar widget
      • Line chart widget
        • Customize your Line chart
      • Monitoring widget
      • Pie chart widget
      • Punch card widget
      • Sectored pie chart widget
      • Table widget
      • Time heatmap widget
      • Tree diagram widget
      • Voronoi tree widget
    • Configuring and sharing dashboards
  • Panels
    • Using panels
    • Create and customize a panel
    • Adding an alert to a panel
    • Adding a query to a panel
  • Alerts and notifications
    • Configuring alerts
      • Create a new alert
        • Alert trigger methods
      • Set up an inactivity alert
      • Create an alert over an alert
      • Activate or deactivate an alert
      • Create a delivery method
        • Email delivery methods
        • HTTP-JSON delivery methods
        • Service Desk delivery methods
        • Jira delivery methods
        • Pushover delivery methods
        • PagerDuty delivery methods
      • Create an anti-flooding policy
      • Create a sending policy
      • Assign a sending policy to an alert
      • Make an alert available for panels
      • Modify or delete an alert
    • Managing triggered alerts
      • Add a comment to a triggered alert
      • Apply a filter for post-processing
    • Pre-installed alert reference
    • Notifications
  • Applications
    • Security Insights
      • Installing Security Insights
        • Security alerts
      • Navigating the Security Insights application
        • Overview tab
        • Threats tab
        • Network tab
        • DNS tab
        • Proxy tab
        • Firewall tab
        • Web tab
        • IDS tab
  • Social Intelligence
  • API reference
    • REST API v2
      • Authorization methods
      • How to query with API v2
        • Forwarding query responses to HDFS
        • Forwarding query responses to Kafka
        • Forwarding query responses to S3
        • Send requests with Postman
      • Job requests
    • Provisioning API
    • OData API feeds management
      • Connecting with Excel
      • Connecting with Tableau
      • Connecting with Power BI
PREVIOUS
Time heatmap
NEXT
Data enrichment

Querying your data / Working in the query window / Generate charts / Voronoi treemap

Download as PDF

Voronoi treemap

Description

A Voronoi treemap plots points on a two-dimensional plane and draws polygons around each point such that the distance from the center point to an edge of its polygon is equal to the distance from the same edge to the point in the adjacent polygon. Polygons can be subdivided by secondary parameters. 

Required field Data type
Signals Discrete variable of any data type except ip. If you want to include IP addresses in a Voronoi diagram, be sure that they are first converted to string values in the query.
Value Number

Creating a Voronoi treemap

Here we describe how to create this chart using an example. We want to analyze the distribution of flights and flight delays depending on the airline.

The following video shows the Voronoi building process and also different ways to get additional information from the diagram:



These are the steps to follow:

  1. Go to Data Search and open the required table.

  2. Perform the required operations to get the data you want to use in the chart.

  3. Select Additional tools → Charts → Diagram → Voronoi treemap from the query toolbar.
  4. Click and drag the column headers to the corresponding fields.


  5. The Voronoi treemap is displayed. This is a visual depiction of the number of flights (the Count value) by airline over one week, with each day depicted by a number within each large cell. 

Customizing the Voronoi treemap

Several options for customizing how you want to visualize this information appear above the treemap:

Size by This dropdown list contains those values specified when generating the treemap. In this example, you can choose between determining cell size based on number of flights (Count) or average flight delay (ArrivalDelayInt). 
Color by By default, colors are applied randomly. Use this option if you want to apply colors based on one of the values used to generate the chart. 
Search Enter text to search for a value in the Voronoi map.
Filter Enter text to filter the chart by a specific value.
LEGEND This is a path that lists the fields added as signals. The first signal in the path is the primary cell grouping, followed by subsequent groupings. Click and drag to change the order of the signals in the path to change the grouping order for cells in the chart.
VALUES When drilling-down into the cells, this shows the values of each grouping.

Click the information icon to display a list of keyboard shortcuts that you will use to navigate the chart and to modify its style and layout:

Types of visualization

T Treemap

Cells are drawn from left to right according to their weight.

F Fisheye

The larger cells appear in the center.

B Blackhole

Smaller cells appear in the center.

R Random

The cells are randomly distributed.

O Ordered

Cells are drawn from top to bottom according to their weight. A cell's size corresponds to its weight.

S Squarified Treemap

The cells are rectangular. Cells are drawn from left to right according to their weight. A cell's size corresponds to its weight.

D Squarified Ordered

The cells are rectangular. Cells are drawn from top to bottom according to their weight. A cell's size corresponds to its weight. By default, in [F], [B] and [R], a cell size does not correspond exactly to its weight (the weight is set by Count or ArrivalDelayInt). In these cases, this is the best view in order to see as many nodes as possible (the cell size is calculated using a Logarithmic function).

P Flattened / Not Flattened visualization

Flattened visualization of all branches, without having to do a drill-down. The Flattened option can be applied to all previous visualization options. Pressing P again will return it to the normal visualization.

Options applicable to all visualizations

Left click Select group, click again to deselect.

CTRL + Left click

Select multiple groups.
Left double click Expose group.

SHIFT + Left double click

Focus on a group. Select a group of cells and analyze them as if they were a separate Voronoi map.
Left click-and-hold Open a group of cells (drill-down).
Right double click  Close group.

SHIFT + Right double click

Blur group.
Right click-and-hold Close group.
Mouse wheel Zoom in / out
Mouse drag Pan around zoomed visualization.

ESC

Unexpose & close all groups.

G

  • Displays detailed information in each cell. Left-click on the cell and then press G. A window will open to the right that will display the following information:
    • Number of children (0 if it is the last branch).
    • Total number of nodes.
    • All parents (0 if it is the top branch).
    • Aggregated values and percentage of the total.

  • Compare multiple cells:
    • By pressing CTRL + cell, you can add cells to the window on the right to compare information (children, nodes, parents and aggregated values).
    • By hovering the mouse over a cell (without clicking), it can be compared to previously added cells.

%

Show / hide percentage in the legend.

V

Show / hide value in the legend.

A

Show / hide percentage of total in the legend.

Z

Show / hide zero values.

L

Calculate cell size using a logarithmic value. This is the best view in order to see as many nodes as possible. Nodes with 20% of the total weight can be the same size as nodes with 5% of the total weight.

N

Calculate cell size using a value. A cell's size corresponds to its weight. Nodes with 20% of the total weight will represent 20% of map's total size, whereas nodes with 1% of the total weight may not even be seen.

M

Show / hide values as bytes.

C

Show / hide values as time (Chrono style).

?

Show / hide this help.

Other Voronoi layouts

Example 1

Visualization of flight delays (ArrivalDelayInt column) by airline over the last week.

  • Press D to apply the Squarified Ordered visualization.
  • Press N to calculate the cells size using their weight.
  • Select count in the Color by field.

The range of colors shows the number of flights (maximum is red, minimum is green) and the cell size represents the delay (the larger they are, the longer the delay).


Example 2

Visualization of the delayed arrival (ArrivalDelayInt) by airline over the last week.

  • Press G and select Alaska Airlines and AirTran Airway by clicking the cells. Move the mouse over the ATA Airlines cell to compare it to the other ones. 
  • Hit the G key again to go back.

Export a Voronoi treemap to a dashboard

A Voronoi treemap created in a data table can be directly exported to a dashboard clicking this icon:

You have to perform an aggregation to make this option available.

After clicking it, you will see the window below. Fill the required information and click Export to send the chart to a dashboard. Click here to learn more about Devo dashboards.



These are the fields to fill in:

Data source


Name Give a name to the data source.
Description Enter a description for the data source.
Tags Add tags to the data source.
Build From Select the date you want events to be sent from.
Minimum Aggregation Period The minimum period to be used in the data aggregation. Select between Auto, 1 minute, 5 minutes or 1 hour.
In real time Check this option if you want data to be sent in real time. If not, uncheck it and select the time difference between the last event and current timestamps in the Delay field.
Dashboards Name Choose an already existing dashboard or create a new one.
Widget Name Name Enter a name for the widget.
Download as PDF

Did you find what you were looking for?

If not, please let us know what you need. Your feedback will help us to improve.

PREVIOUS
Time heatmap
NEXT
Data enrichment

Export

See what Devo can do for you. Request a demo!
Discover what's new (Release notes)
  • Services & Support
  • Devo.com
  • Contact
    • Contact Us
    • Request a Demo
    • Partner Inquiry
  • Log In
    • USA Devo
    • EU Devo
  • +1 888 6830910 (USA)
  • +34 900 838 880 (Spain)
Copyright © 2019 Legal Terms Privacy Policy Cookies Policy

Powered by Confluence and Scroll Viewport