Skip to main content

DashboardDashboards Guide

Table of Contents

Configure Visualization Query Filters

Visualization query filters can be used to tailor the information displayed in the visualization. You can configure a time range filter to show only data from a specific time period. You can configure other filters, or combinations of filters, to specify aspects of dimensions included in the visualization, like certain types of users or activities. Depending on how complex your filter needs to be, you can group filter conditions together with AND or OR operators.

To configure query filters on a visualization:

  1. With the visualization open in edit mode, click the expand arrow (icon-expand.png) on the Filters heading at the top of the right hand panel. The Filters panel fully expands to show two sections: Required Filters and Query Filters.

    Note

    Required Filters cannot be removed.

    The Approx Log Time filter is a required filter for visualizations based on the Event Store data model. It is automatically applied to these visualizations with a default setting of in the last 2 days. As a field, the Approx Log Time is the time that an event was triggered, and this internal filter is designed to avoid slow loading times that can happen with larger queries.

    You can change this time range filter setting to anything within your licensed retention period, but it is not recommended. Instead, you can override it by adding an Approx Log Time filter at the dashboard level and setting it to any time range that you need. For information on creating dashboard filters, see Add Dashboard Filters.

  2. In the Query Filters heading, click the expand arrow (icon-expand.png), if necessary, to open the Query Filter section.

  3. Depending on the query you want to create, select the AND, OR, NOT AND, or NOT OR operator from the drop-down menu on the left. This operator defines the relationship between each of the rule conditions within a group. The default operator is AND.

    query-filter-and-or.png

  4. To add your first query condition, click + Rule. When the new condition row opens, define the query condition as follows:

    • Select a field name from the Field drop down menu. You can start type in the field to find the desired field name.

    • Select an operator from the menu in the middle of the condition row.

      Note

      The list of operators available for specific data type fields is being updated in phases to be consistent with those available across Exabeam New-Scale applications. Most recently, support for the following operators has been removed when creating new filters with IP data type fields: starts with, ends with, does not start with, does not end with. Existing visualizations that are filtered using these operators on IP data type fields will not change. However, it's recommended that you update them with supported operators when you encounter them.

    • If applicable, enter a value in the text field on the right of the condition row. If you enter multiple values, they are connected by an OR.

    query-filter-rule.png

  5. To add another condition, click + Rule again to add another row and define a new condition with field name, operator, and value.

  6. To add a new group of condition rules, click + Group. A new condition group is added to the Query Filters panel.

  7. Depending on how you want the rule conditions in the new group to be connected to each other, select the AND, OR, NOT AND, or NOT OR operator from the drop-down menu on the left. The default operator is AND.

    query-filter-group-and-or.png

  8. Click + Rule and define the conditions for each rule you want to add to the new group. You can add multiple groups of conditions. To remove a condition or a group, click the delete icon (icon-delete.png) next to it.

  9. When you have built all of the filter conditions you need, you can review the filter as a query string. Click the collapse arrow (icon-collapse.png) in the top right corner of the Query Filters panel. To view the filter conditions, click the expand arrow (icon-expand.png).

    query-filter-string.png

  10. If you want to apply a context filter to your visualization, click the + Context Filter option at the bottom of the Query Filters panel and then click the expand arrow to open a condition row. You can add up to two context filters to the end of the filter panel and they must be connected by an AND relationship to the other filter conditions. To define context filters, enter the following information for each context filter you add:

    • Context Field – A field that is assigned as the key attribute in a context table.

    • Operator – Select the appropriate option depending on whether you want to search for data that is or is not present in the context table.

    • Context Table – Select the name of the context collector that you want to include in the visualization filter.

    query-filter-context.png

    For more information about including context tables in a query filter, see Include Context Filtering in Visualizations.

  11. When you finish building your query filters, click the Run Data button on the left to see if the filters produce the desired results in the data your visualization displays.

  12. To save the query filters, click Save or Add, depending on how you opened the visualization for editing.