Working in the search window

Once you open a data table, you are redirected to the search window, where all the events corresponding to the tag you have selected appear arranged in rows and columns, forming the data table. This is where you can start to query your data, apply operations using the set of tools in the toolbar and customize the aspect of the data table, rearranging columns, filtering the data, etc.

The search window contains the following elements, as exemplified in the image below:

• 1. Event timeline
• 2. Query code editor
• 3. Event loading indicator
• 4. Time range selector
• 5. Search window toolbar
• 6. Applied query operations
• 7. Column header menu
• 8. Data table

1. Event timeline

This useful graph shows a count of the queried events over the period of time set in the From and To fields of the time range selector.

New events, that become rows in the table, arrive constantly. With this graph, you can see what was the count of events corresponding to that tag, that had arrived at the system at that specific time. The data counts represented in the timeline are plotted before the actual events are loaded in the browser. To avoid overloading the browser's memory, not all the events in the data table are downloaded to the browser. Instead, Devo downloads events in interval blocks within the time range selected. This is important to understand, especially with respect to using the Get Server Counts and Event Loading Indicator described below.

The timeline is a dynamic graph and gives you the ability to:

• Hover over the timeline to show the count of events at a specific time.
• Click and drag the mouse across a segment of the timeline to display only the event count and data for that period, narrowing the range of analysis. Use the Back button to go back to previously selected periods.
• Click on the timeline to rerender the data table with the events available at that date and time. In this way, you can use the timeline to navigate the events in the table. If the events from the selected date/time have not yet been downloaded to the browser, this will download them. When this occurs, a blue band appears in the timeline indicating those events that are being downloaded to the browser. Alternatively, you can use the table scroll bar to download events to the data table.

The following table describes the settings above the timeline:

The timeline appears embedded at the top of the search window by default. You can pop it out of the window so you can place it freely on your screen, or you can close it. After closing it, you can open it again by clicking the gear icon in the toolbar and then selecting Tools → Event timeline.

2. Query code editor

The Query code editor allows users to easily modify their queries and see the results immediately on the table below. Besides, the query editor will update your query any time you perform a modification to your query using the search window interface. In Devo, queries are written in LINQ language. Learn more about LINQ in Build a query using LINQ.

To modify your query, just click the editor. The window will expand and you can start adding the required modifications. After clicking Apply, the query results will be shown on the table.

Click this icon to detach the query editor from the search window, so you can place it wherever you prefer.

Click the X icon at the top right corner of the editor to close it. To open it again, click the Query code editor icon on the toolbar.

3. Event loading indicator

Devo automatically controls how events are loaded in order to maintain optimal browser performance while at the same time fulfilling user requests for viewing and working with their data.

This reports what percentage of the query's time range has been loaded in the browser so far. For example, if the time range is set to 24 hours and 12 hours of data has been loaded, the progress indicator will report 50%.

Click the indicator to open the Event Loading Preferences. This shows you a more detailed summary of the event loading status and gives you access to some preferences that give you greater control over how events are loaded.

Keep in mind that both the Event count and Browser memory are limited by the thresholds established in the domain preferences, with the inferior value being the limit.

Here's a description of these preferences:

The Event Loading Status details include:

4. Time range selector

These tools allow you to apply filters by time. To narrow your search, you can select a specific time range. Use extended periods to analyze long-term patterns like an advanced persistent threat. You can perform the following actions:

Set a new time interval

Select the new interval in the From and To fields, then click Apply Interval to update the data table. Click the Back button to return to the previous time setting.

Activate or deactivate real-time data flow

Click the spinning clock icon to suspend or reestablish the flow of real-time data. In some cases of extremely large volumes of data, real-time data flow will stop automatically and a warning message will be shown above the table. This is done to prevent the browser from crashing.

Apply previously used time intervals

Use the Back button to apply previously selected time intervals in your query.

Additionally, the Time interval history tool allows you to easily apply previously selected time periods in the current or other data tables, to facilitate the analysis of data over time. The results can be used in reports or to create dashboard data sources from different time intervals.

Select the required interval in the Available Time Intervals area. When there are multiple active queries, checkboxes will be available to let you apply the interval to more than one query. The current query is selected by default.

5. Search window toolbar

This toolbar offers a rich set of tools to work with the table data including grouping, aggregation, data download, and more. Hover over each icon to see its tooltip. These are the default tools displayed in the toolbar:

You can customize the default toolbar configuration to provide quick access to the tools that you use most frequently. You can perform the following actions to customize your toolbar as needed.

Add new tools to the toolbar and manage them

Select the gear icon on the toolbar (Additional tools) and navigate to the required tool in the list. Point its icon and when the cursor becomes a move pointer, drag and drop the tool into the table toolbar. The icon will appear as the first tool in the toolbar.

To change the order of the tools, select the tool you want to move and drag it to the new position in the toolbar. To remove an icon from the table toolbar, select, hold and move it to the dynamic trash bin that appears, as seen above.

Save and restore the toolbar configuration

After adding the tools you use the most to the toolbar and move them as required, click the gear icon on the toolbar and select Workspace → Save current Workspace. The custom toolbar will appear the next time you access the search window, no matter the data table you open. Select Workspace→ Reset Workspace to default to restore the original toolbar configuration.

6. Applied operations bar

Any operations you apply on the table when building your query will appear listed above the data table. This way, you can easily consult the operations affecting the data, modify them, or undo operations. You can go back to any of the operations applied and start a new path of actions from there.

Select the Node tree tool to display a visual record of all the modifications applied to the original data table. The actions and their sequences are displayed in a tree, known as the search tree. Select any point in the tree to display the query results at that point in the sequence of modifications. If you select an operation in a branch different from the current one, that path will be shown in the applied operations bar.

Each tab in the bar/node in the tree appears in a color that denotes the type of action taken. The color code is described here:

See Build a query in the search window to learn more about how to transform and work with query data.

7. Column header menu

Hover over any column header and click the arrow icon that appears to show the column header menu. You will see the name of the column and the data type of its values. The icons at the top of the menu allow you to perform the following actions:

• Highlight the column. You can also do this by clicking the column header.
• Expand or shrink the column to the default size. You can also adjust the size of the columns dragging the top right side of the header. Learn more here.
• Hide the column. To display it again, select Column → Show hidden columns on the toolbar. Learn more here.

The menu also shows the top 10 distinct values with the highest number of instances in the column.

You can perform the following actions in the top 10 list:

Filter data by a specific value

Click one of the values in the list to get only events with that specific value in that column. The Operations over columns window will be open in the Filter tab, and the Equal (eq, =) operation selected. 

Apply an Or filter using one or several values

Select the checkbox of any value from this list. Now select at least one more value from the list to add it to an Or filter. You can also select column values from other columns.

8. Data table

In the data table, each row represents an event and each column represents a data value correctly recognized by Devo. If the data is not separated by several columns or is shown in the unknown tag structure of the search view, it is normally due to missing or incorrect tags. Learn more about tags here. The data displayed in the table will change according to the operations you apply to build your query (filters, new columns...). Learn more about building queries here.

Data table shortcuts

You can perform the following actions in the data table: