Administration Guide › Queries and Reports › How to Create a Query › Create a Query Display Visualization

Create a Query Display Visualization

To create a new query display you must set the Visualization details that control how the event information appears.

To create a query display visualization

1. Open the query design wizard.
2. Enter the name and tag, if not already specified, then advance to the Visualization step.
3. Choose whether you want your query display to use an Event Viewer or Chart.

   If you choose Event Viewer, the visualization step is complete. The event columns appear in the Event Viewer display in the order in which you placed them during the Query Columns construction step.

4. If you choose a Chart, you can select one or more chart types. Selecting multiple chart types allows users to toggle back and forth between them in the report display. The up and down arrows that appear beside each type control the order in which they appear in the Change Visualization menu.

   Note: Table is always available as a visualization even if you do not add it during this step.

5. Select the event you want to appear as the X (horizontal) Axis from the column drop-down, enter label text if you want any to appear, and select one of the following options from the display type menu:
   • Category - Use this option for string or text value columns, such as source_username.
   • Linear - Use this option for numeric values, such as event_count. When the values are widespread, you can use the Log Axis check box to allow the axis to be logarithmic
   • Datetime - Use this option to display time values in the local date/time.
6. Repeat Step 4 using the Y-Axis Settings menus to set the Y (vertical) Axis column, label, and type options.
7. Click the appropriate arrow to advance to the Query Design step you want to complete next, or click Save and Close.

   If you click Save and Close the new query appears in the Query List, otherwise the Query Design step you choose appears.