Working in the search window
Once you open a data table, you are redirected to the search window, where all the events corresponding to the tag you have selected appear arranged in rows and columns, forming the data table. This is where you can start to query your data, apply operations using the set of tools in the toolbar and customize the aspect of the data table, rearranging columns, filtering the data, etc.
The search window contains the following elements, as exemplified in the image below:
Search window elements
You can find detailed information about each element shown in the picture above by clicking on the corresponding number in the tabs below.
1. Event timeline
The timeline appears embedded at the top left of the search window by default. You can pop it out of the window so you can place it freely on your screen, or you can close it. After closing it, you can open it again by clicking the gear icon in the toolbar and then selecting Tools → Event timeline.
This useful graph shows a count of the queried events over the period of time set in the Time range selector (more info on the Time range selector in tab 4). The data counts represented in the timeline are plotted before the actual events are loaded in the browser. To avoid overloading the browser's memory, not all the events in the data table are downloaded to the browser. Instead, Devo downloads events in interval blocks within the time range selected. This is important to understand, especially with respect to using the Get Server Counts and Event Loading Indicator described below.
The timeline is a dynamic graph and gives you the ability to:
The following table describes the settings above the timeline:
2. Query code editor
The query code editor appears embedded at the top right of the search window by default. You can click the window icon at the top right to detach it from the search window so that you can place it wherever you prefer. You can click the X icon at the top right corner to close it. To open it again, click the Query code editor icon on the toolbar.
The Query code editor allows users to easily modify their queries and see the results immediately on the table below. Besides, the query editor will update your query any time you perform a modification to your query using the search window interface. In Devo, queries are written in LINQ language. Learn more about LINQ in Build a query using LINQ.
To modify your query, just click the editor. The window will expand and you can start adding the required modifications. After clicking Apply, the query results will be shown on the table.
3. Event loading indicator
Devo automatically controls how events are loaded in order to maintain optimal browser performance while at the same time fulfilling user requests for viewing and working with their data.
This reports what percentage of the query's time range has been loaded in the browser so far. For example, if the time range is set to 24 hours and 12 hours of data has been loaded, the progress indicator will report 50%.
Click the indicator to open the Event Loading Preferences. This shows you a more detailed summary of the event loading status and gives you access to some preferences that give you greater control over how events are loaded.
Keep in mind that both the Event count and Browser memory are limited by the thresholds established in the domain preferences, with the inferior value being the limit.
Exercise caution when modifying these preferences. By forcing Devo to load and maintain large amounts of data in the browser, you are likely to experience performance degradation and even browser failure.
4. Time range selector
You can use this menu to select a time period for the data shown on the table. You can select a short time range to narrow down your search or you can use an extended period to analyze long-term patterns like an advanced persistent threat. You can perform the following actions:
Set a new time interval using the interface
You can set a time interval following the steps described in the picture below. When setting time ranges, it is important to consider different aspects related to the type of time range specified and the method chosen to do it. You can use the interface to set absolute, relative, or snap-to dates:
Snap to the day: you will see data beginning at 00:00 on that same Tuesday.
Set a new time interval using date language expressions
You can also introduce time ranges manually using date language expressions, which gives you more flexibility and precision when searching your data. Simply click on the date field and write the desired time expression or edit the existing one. The field turns red and an explanatory message appears until a valid date is entered. Click Apply when you finish and the expressions will be translated into the corresponding dates.
Your from date cannot be after your to date and your to date cannot be in the future.
You can use a mix of both absolute and date language expressions in any given time range (for example, the to date can be relative and the from date absolute, and vice versa). For date language expressions, the current moment "now()" is used as the reference point.
Click here to see the operators...
You can establish absolute dates in the required format:
With date language expressions, use a series of mathematical operations to move away from the current time which is used as the reference point. You can use multiple operators at once and the execution order is from left to right:
Click here to see examples on time expressions...
Let's suppose the current time (which we refer to as "now()") is Sunday, 05 February 2017, 13:37:05. The table below shows the resulting time when different expressions are applied. Note that this isn't an exhaustive list:
Activate or deactivate real-time data flow
Click the RT icon to suspend or reestablish the flow of real-time data. In some cases of extremely large volumes of data, real-time data flow will stop automatically and a warning message will be shown above the table. This is done to prevent the browser from crashing.
Users with the necessary permissions can determine if real-time data flow is active or inactive by default when users run searches. Go to Preferences → Domain Preferences → Global to access this setting. For more information, see Domain preferences.
Apply previously used time intervals
Use the Back button to apply previously selected time intervals in your query.
Additionally, the Time interval history tool allows you to easily apply previously selected time periods in the current or other data tables, to facilitate the analysis of data over time. The results can be used in reports or to create dashboard data sources from different time intervals.
Select the required interval in the Available Time Intervals area. When there are multiple active queries, checkboxes will be available to let you apply the interval to more than one query. The current query is selected by default.
5. Time control settings
This feature has limited availability. If you have any doubts or questions do not hesitate to reach out to us.
Data in Devo is indexed by ingestion time (eventdate) by default, which means that filtering and grouping by the event date are optimized. With this new feature, we have added a new time index over the creation time of the events (creationdate field), so queries over this field are also optimized.
The event date is when Devo receives and ingests data. On the other hand, the creation date is considered as when data is generated at its source. For this reason, the event date is always after the creation date, although in many cases there is a negligible difference between both. Sometimes there is a large difference between both dates and a user is interested in the creation date being the time reference for their data. For example, imagine a machine that generates events, which is then switched off during a whole day and the events arrive into Devo the next day: in this case the event date and creation date would differ.
The time control button is located to the left of the date picker in the search window and serves as a visual indicator of whether time control is activated, as well as which time reference you are using for your table. We recommend you refrain from switching between both time reference options when running queries as the results returned might not be correct.
Once activated, use this button to select the time reference for your current search:
Get more information about the time control feature in this article.
6. Search window toolbar
This toolbar offers a rich set of tools to work with the table data including grouping, aggregation, data download, and more. Hover over each icon to see its tooltip. These are the default tools displayed in the toolbar:
You can customize the default toolbar configuration to provide quick access to the tools that you use most frequently. You can perform the following actions to customize your toolbar as needed.
Add new tools to the toolbar and manage them
Select the gear icon on the toolbar (Additional tools) and navigate to the required tool in the list. Hover over its icon and when the cursor changes shape, drag and drop the tool into the table toolbar. The icon will appear as the first tool in the toolbar.
To change the order of the tools, select the tool you want to move and drag it to the new position in the toolbar. To remove an icon from the table toolbar, select, hold and move it to the dynamic trash bin that appears, as seen above.
Save and restore the toolbar configuration
After adding the tools you use the most to the toolbar and move them as required, click the gear icon on the toolbar and select Workspace → Save current Workspace. The custom toolbar will appear the next time you access the search window, no matter the data table you open. Select Workspace→ Reset Workspace to default to restore the original toolbar configuration.
7. Applied operations bar
Any operations you apply on the table when building your query will appear listed above the data table (see Build a query in the search window to learn more about how to transform and work with query data). This way, you can easily consult the operations affecting the data, modify them, or undo operations. You can go back to any of the operations applied and start a new path of actions from there.
Each tab in the bar/node in the tree appears in a color that denotes the type of action taken. The color code is described here:
Select the Node tree tool to display a visual record of all the modifications applied to the original data table. The actions and their sequences are displayed in a tree, known as the search tree. Select any point in the tree to display the query results at that point in the sequence of modifications. If you select an operation in a branch different from the current one, that path will be shown in the applied operations bar.
8. Column header menu
Hover over any column header and click the arrow icon that appears to show the column header menu. You will see the name of the column and the data type of its values. The icons at the top of the menu allow you to perform the following actions:
The menu also shows the top 10 distinct values with the highest number of instances in the column.
This list shows only the data that has been loaded in the browser so far and corresponds to the percentage indicated in the Event loading indicator (more info on the Event loading indicator in tab 3). Due to this, note that you may not see some of the values in your query when you use the search box to filter the list. Filter the data in the table if you want to verify that the values you are looking for exist or not.
Filter data by a specific value
Click one of the values in the list to get only events with that specific value in that column. The Operations over columns window will be open in the Filter tab, and the Equal (eq, =) operation selected.
Apply an Or filter using one or several values
Select the checkbox of any value from this list. Now select at least one more value from the list to add it to an Or filter. You can also select column values from other columns.
9. Data table
In the data table, each row represents an event and each column represents a data value correctly recognized by Devo. If the data is not separated by several columns or is shown in the unknown tag structure of the search view, it is normally due to missing or incorrect tags. Learn more about tags here. The data displayed in the table will change according to the operations you apply to build your query (filters, new columns...). Learn more about building queries here.
Data table shortcuts
You can perform the following actions in the data table: