Document toolboxDocument toolbox

Voronoi treemap

Overview

In a Voronoi treemap, you can see the values of the columns you add, portrayed as a tessellation of polygons whose proportions depend on a numeric column you choose. These polygons may be subdivided into smaller polygons and constitute a hierarchical structure with as many levels as those into which the data is divided (there is a legend above the chart explaining the hierarchy of data).

What data do I need for this widget?

The option to create this chart will be disabled unless your query contains at least two columns, one of them with numeric values. Furthermore, to show meaningful content on the chart, you must group your data by at least two keys using a no-time option. Also, it is highly advisable to add some aggregation functions to provide mathematical significance to the variables you want to analyze.

Time grouping

If you grouped using a time option, the diagram will only show the data for the latest period available for the time range specified.

Creating a Voronoi treemap

Here we describe how to create this chart using examples. Let's go step by step through the process with another example:

Customizing the Voronoi treemap

Several options for customizing how you want to visualize this information appear above the treemap:

Size by

This dropdown contains those variables added to the value field when generating the treemap. You can switch between them to use their values as the criteria to establish the proportions of the cells.
In this example, you can choose between determining cell size based on the average response length (avg_responseLength) for each grouping occurrence (city-responseTime) or the number of events for each grouping occurrence (Count).

Color by

By default, cell colors are applied randomly without any color spectrum that visually correlates cells and values. This dropdown contains those variables added to the value field when generating the treemap and selecting one of them will establish a color spectrum using its minimum and maximum values as cardinal points (green-red). Cells will be colored to reflect the position of their value inside that spectrum.

Partitioning

By default, cell outlines are colored in black without using a pattern that visually correlates outlines and values. This dropdown contains those variables added to the value field when generating the treemap and selecting one of them will color the cell outlines to reflect the status of their values in relation to the optimal status (green to red).

Search

Enter text to search for a value in the Voronoi map. The cells containing the specified string will be highlighted, together with their children if any.

Filter

Enter text to filter the chart by a specific value. Only the cells matching the string will be shown, together with their children if any.

Legend

This is a path that lists the fields added as signals. The first signal in the path is the primary cell grouping, followed by subsequent groupings. Click and drag to change the order of the signals in the path to change the grouping order for cells in the chart.

Values

When drilling-down into the cells, this shows the values of each grouping.

Click the information icon to display a list of keyboard shortcuts that you will use to navigate the chart and to modify its style and layout:

T Treemap

Cells are drawn from left to right according to their weight (from larger to smaller).

F Fisheye

Larger cells appear in the center.

B Blackhole

Smaller cells appear in the center.

R Random

Cells are randomly distributed.

O Ordered

Cells are drawn from top to bottom according to their weight (from larger to smaller). A cell's size corresponds to its weight.

S Squarified Treemap

Cells are rectangular and drawn from left to right according to their weight (from larger to smaller). A cell's size corresponds to its weight.

D Squarified Ordered

Cells are rectangular and drawn from top to bottom according to their weight (from larger to smaller). A cell's size corresponds to its weight.

P Flattened / Not Flattened visualization

Flattened visualization of all branches, without having to do a drill-down. The Flattened option can be applied to all previous visualization options. Pressing P again will return it to the normal visualization.

There several ways to navigate the Voronoi treemap which are applicable to all visualization options:

Left click

Select group, click again to deselect.

CTRL + Left click

Select multiple groups.

Left double click

Expose group.

SHIFT + Left double click

Focus on a group. Select a group of cells and analyze them as if they were a separate Voronoi map.

Left click-and-hold

Open a group of cells (drill-down).

Right double click 

Close group.

SHIFT + Right double click

Blur group.

Right click-and-hold

Close group.

Mouse wheel

Zoom in / out

Mouse drag

Pan around zoomed visualization.

ESC

Unexpose & close all groups.

G

Displays detailed information in each cell. Left-click on the cell and then press G. A panel will open to the right to display the following information:

  • Number of children (0 if it is the last branch).

  • Total number of nodes.

  • All parents (0 if it is the top branch).

  • Aggregated values and percentage of the total.

Compare multiple cells:

  • Press CTRL and click cells to add them to the lower part of the right panel to see their information (children, nodes, parents and aggregated values).

  • Hover over a cell (without clicking) to see its information at the top of the right panel and compare it to the previously added cells. The differences will be shown in red if the values are worse and green if the values are better.

%

Show/hide percentage in the legend.

V

Show/hide value in the legend.

A

Show/hide the percentage of the total in the legend.

Z

Show/hide zero values.

L

Calculate cell proportions using a logarithmic value to normalize size. This way, nodes with 20% of the total weight can be the same size as nodes with 5% of the total weight. This option is recommended when having very polarized values and needing an exhaustive approach in which value omission is not admissible for the purpose of the analysis. This way, we avoid having very tiny cells that might be almost invisible or even omitted from the diagram.

N

Calculate cell proportions using real aggregated values so a cell's size corresponds to its weight. Nodes with 20% of the total weight will represent 20% of map's total size, whereas nodes with 1% of the total weight may not even be seen. This option is recommended when needing a generalistic approach in which marginal values can be omitted without substantially affecting the analysis. This way the correspondence of values and sizes can be easily identified at a glance.

M

Show/hide values as bytes.

C

Show/hide values as time (Chrono style).

?

Show/hide this help.

Other Voronoi layouts

Visualization of the average response length (avg_responseLength column) per city over the last day and comparison of three of the cities.

  • Press G and select Knoxville and Alcorcon by pressing Ctrl + clicking the cells. Move the mouse over the Madrid cell to compare it to the other ones. 

The cells selected will appear at the lower part of the right panel while the cell over which you hover will appear at the top, showing in both cases their information and aggregated values. The one at the top will be compared to those at the bottom, showing their differences in red or green (fewer or worse).

  • Hit the G key again when you finish to go back and remove the comparison panel to the right.

Query example

You can recreate the example explained above with the data from the following query and mapping the fields as follows:

Query

Required field

Column added

Query

Required field

Column added

from siem.logtrust.web.activity group by city, responseTime every - select avg(responseLength) as avg_responseLength, count() as count

Signals

city
responseTime

Value

avg_responseLength
count