Page Comparison

Which data do I need to generate my report?

As this is a time series report, you must have a time-based grouping with no keys to enable this option. However, you also need a numeric column in your query to generate your report. You must transform your data as required to include a numeric column that will be used to feed the report (for example, through an aggregation operation):

from siem.logtrust.web.activity
group every 5m
every 5m
select count() as count

The following query does not meet the requirements for a time series report, as the grouping is non-time based:

from siem.logtrust.web.activity

group

select count() as count