Overview
In a Voronoi treemap, you can see the values of the columns you add, portrayed as a tessellation of polygons whose proportions depend on a numeric column you choose. These polygons may be subdivided into smaller polygons and constitute a hierarchical structure with as many levels as those into which the data is divided (there is a legend above the chart explaining the hierarchy of data).
The option to create this chart will be disabled unless your query contains at least two columns, one of them with numeric values. Furthermore, to show meaningful content on the chart, you must group your data by at least two keys using a no-time option. Also, it is highly advisable to add some aggregation functions to provide mathematical significance to the variables you want to analyze.
Creating a Voronoi treemap
Here we describe how to create this chart using examples. Let's go step by step through the process with another example:
Customizing the Voronoi treemap
Configuration options
Several options for customizing how you want to visualize this information appear above the treemap:
Size by | This dropdown contains those variables added to the value field when generating the treemap. You can switch between them to use their values as the criteria to establish the proportions of the cells.
In this example, you can choose between determining cell size based on the average response length (avg_responseLength) for each grouping occurrence (city-responseTime) or the number of events for each grouping occurrence (Count). |
|---|
Color by | By default, cell colors are applied randomly without any color spectrum that visually correlates cells and values. This dropdown contains those variables added to the value field when generating the treemap and selecting one of them will establish a color spectrum using its minimum and maximum values as cardinal points (green-red). Cells will be colored to reflect the position of their value inside that spectrum. |
|---|
Partitioning | By default, cell outlines are colored in black without using a pattern that visually correlates outlines and values. This dropdown contains those variables added to the value field when generating the treemap and selecting one of them will color the cell outlines to reflect the status of their values in relation to the optimal status (green to red). |
|---|
Search | Enter text to search for a value in the Voronoi map. The cells containing the specified string will be highlighted, together with their children if any. |
|---|
Filter | Enter text to filter the chart by a specific value. Only the cells matching the string will be shown, together with their children if any. |
|---|
Legend | This is a path that lists the fields added as signals. The first signal in the path is the primary cell grouping, followed by subsequent groupings. Click and drag to change the order of the signals in the path to change the grouping order for cells in the chart. |
|---|
Values | When drilling-down into the cells, this shows the values of each grouping. |
|---|
Visualization options
Click the information icon to display a list of keyboard shortcuts that you will use to navigate the chart and to modify its style and layout:
T Treemap | Cells are drawn from left to right according to their weight (from larger to smaller). |
|---|
F Fisheye | Larger cells appear in the center. |
|---|
B Blackhole | Smaller cells appear in the center. |
|---|
R Random | Cells are randomly distributed. |
|---|
O Ordered | Cells are drawn from top to bottom according to their weight (from larger to smaller). A cell's size corresponds to its weight. |
|---|
S Squarified Treemap | Cells are rectangular and drawn from left to right according to their weight (from larger to smaller). A cell's size corresponds to its weight. |
|---|
D Squarified Ordered | Cells are rectangular and drawn from top to bottom according to their weight (from larger to smaller). A cell's size corresponds to its weight. |
|---|
P Flattened / Not Flattened visualization | Flattened visualization of all branches, without having to do a drill-down. The Flattened option can be applied to all previous visualization options. Pressing P again will return it to the normal visualization. |
|---|
Navigation options
There several ways to navigate the Voronoi treemap which are applicable to all visualization options:
Left click | Select group, click again to deselect. |
|---|
CTRL + Left click | Select multiple groups. |
|---|
Left double click | Expose group. |
|---|
SHIFT + Left double click | Focus on a group. Select a group of cells and analyze them as if they were a separate Voronoi map. |
|---|
Left click-and-hold | Open a group of cells (drill-down). |
|---|
Right double click | Close group. |
|---|
SHIFT + Right double click | Blur group. |
|---|
Right click-and-hold | Close group. |
|---|
Mouse wheel | Zoom in / out |
|---|
Mouse drag | Pan around zoomed visualization. |
|---|
ESC | Unexpose & close all groups. |
|---|
G | Displays detailed information in each cell. Left-click on the cell and then press G. A panel will open to the right to display the following information: Number of children (0 if it is the last branch). Total number of nodes. All parents (0 if it is the top branch). Aggregated values and percentage of the total.
Compare multiple cells: Press CTRL and click cells to add them to the lower part of the right panel to see their information (children, nodes, parents and aggregated values). Hover over a cell (without clicking) to see its information at the top of the right panel and compare it to the previously added cells. The differences will be shown in red if the values are worse and green if the values are better.
|
|---|
% | Show/hide percentage in the legend. |
|---|
V | Show/hide value in the legend. |
|---|
A | Show/hide the percentage of the total in the legend. |
|---|
Z | Show/hide zero values. |
|---|
L | Calculate cell proportions using a logarithmic value to normalize size. This way, nodes with 20% of the total weight can be the same size as nodes with 5% of the total weight. This option is recommended when having very polarized values and needing an exhaustive approach in which value omission is not admissible for the purpose of the analysis. This way, we avoid having very tiny cells that might be almost invisible or even omitted from the diagram. |
|---|
N | Calculate cell proportions using real aggregated values so a cell's size corresponds to its weight. Nodes with 20% of the total weight will represent 20% of map's total size, whereas nodes with 1% of the total weight may not even be seen. This option is recommended when needing a generalistic approach in which marginal values can be omitted without substantially affecting the analysis. This way the correspondence of values and sizes can be easily identified at a glance. |
|---|
M | Show/hide values as bytes. |
|---|
C | Show/hide values as time (Chrono style). |
|---|
? | Show/hide this help. |
|---|
Other Voronoi layouts
Example 1
Visualization of the average response length (avg_responseLength column) per city over the last day and comparison of three of the cities.
The cells selected will appear at the lower part of the right panel while the cell over which you hover will appear at the top, showing in both cases their information and aggregated values. The one at the top will be compared to those at the bottom, showing their differences in red or green (fewer or worse).
Example 2
Visualization of the average response length (avg_responseLength column) per city over the last day, ordered by size and colored using a spectrum based on the average response length (avg_responseLength column).
Press D to apply the Squarified Ordered visualization.
Press N to calculate cell size using their weight.
Select avg_responseLength in the Color by field.
The spectrum of colors shows the average response length (maximum is red, minimum is green) and the cell size represents also the average response length (the larger they are, the longer the response). With this visualization, we establish a correlation between size and color, making it easier to spot potential problems by looking at big red cells.
Query example
You can recreate the example explained above with the data from the following query and mapping the fields as follows:
Query | Required field | Column added |
|---|
from siem.logtrust.web.activity
group by city, responseTime
every -
select avg(responseLength) as avg_responseLength,
count() as count
| Signals | city
responseTime |
Value | avg_responseLength
count |
