About the Bar Chart Visualization Type

Use the Bar Chart visualization type to show aggregate counts of values for a single field.

(Click the image to enlarge it.)

AQL Expression Requirements

The bar chart visualization type is used to show counts. The query must have the following elements to return the required data:

  • A result set having a string column and a numeric column.

  • Use the aggr operator, which returns a numeric value.

The following is an example of a query that returns the required data:

Copy 
| aggr count as cnt by sourcetype | sort cnt desc | limit 10

Note: Using addtotals=true in your timechart operator query appends a total row and total column to your results. The total row shows the aggregate count per group across the entire time range, and the total column shows the aggregate count across all groups per time bucket. This is useful for comparing entities and spotting volume trends, without needing a separate query. See timechart operator for more information.

Panel Options

Use the options in the Panel tab to customize the options described in the following table.

Setting   Description
Settings Panel title Titles appear at the top of a panel.
Description Descriptions appear as tooltips. Markdown and links are supported.
Transparent Display panel without a background.
Show Description Display or hide the description.
Visualization Bar chart

Select the Bar chart widget to create bar charts.
Display Orientation

  • Auto

  • Horizontal: Count is x-axis.

  • Vertical: Count is y-axis.
Rotate x-axis tick labels Use the slider to rotate the label text as needed to enhance readability.
Stacking Select whether to stack bars in the chart.
Show values

Show counts above or at the end of bars.

  • Auto

  • Always

  • Min/Max

  • Never
Value format Select whether to display the full bar value or its nearest approximate value.
Group width Use the slider to adjust the width of bar groups.
Bar width

Use the slider to adjust the width of bars.
Show decimals
 Show decimals in the values.
X Axis

Select the field to be mapped on the x-axis. By default, no field is selected.

When no field is selected, the widget automatically displays all the available series data for all the fields.
Hide series Select one or more fields that you would like to hide.
Legend mode

  • List

  • Table

  • Hidden
Legend placement

  • Bottom

  • Right
Legend calculations Select functions. Advanced users only.

Field Options

Use the options in the Fields tab to customize the options described in the following table.

Setting   Description
Bar chart options Line width Use the slider to adjust the bar border width.
Fill opacity Use the slide to adjust the bar fill.
Gradient mode

  • None

  • Opacity

  • Hue

Sensitivity of this setting is affected by fill opacity and line color.
Axis Placement

  • Auto

  • Left

  • Right

  • Hidden
Label Additional label for y-axis.
Width By default, the width is calculated automatically based on the results data. If desired, specify a fixed width instead.

Soft min

Soft max

 By default, the Y-axis limits are determined automatically based on the results data. Adjust these settings if the automatic behavior distorts the visualization.
Thresholds Add threshold Configure mapping of thresholds to colors.
Thresholds mode

  • Absolute

  • Percentage
Standard options Unit Select a unit. Applies to all fields except time.
Min

Specify a minimum value (as percentile).

Leave empty to calculate based on all values.
Max

Specify a maximum value (as percentile).

Leave empty to calculate based on all values.
Decimals Number of decimal places in numeric values.
Display name Change the field or series name.
No value What to show when there is no value.
Color scheme Specify a single color or use the color palette.
Value mappings Add value mapping Click +Add value mapping to map a single value or range of values to a specified text string. For example, map data having the country code SG to the text Singapore.
Data links Add link

Click +Add link and complete settings for link behavior when a user clicks data fields in the visualization.

You can use the following URL types and configure them to pass variables:

  • Relative URL – URL that will open a new Search page with a specified search query.

  • URL in ThreatStream or Security Analytics domains – URL that will open a page or a specific object in ThreatStream or Security Analytics.

To use a relative URL, specify /xdr/gf/m/a/?query= in the URL field, and then provide a search query. You can type a $ to display a list of variables that can be inserted into the query.

To use a URL in ThreatStream or Security Analytics domains, do the following:

  1. Type a $ in the URL field to display a selection list of variables that can be inserted into the URL pattern, and then select Domains Threatstream or Domains Security Analytics.

  2. Using /, specify the page or a link to an object in ThreatStream or Security Analytics, and then click Save.

    In the example above, when a user clicks any part of the visualization, the Investigations page in ThreatStream will open.

Advanced Options

Use the options in the Advanced tab to override the settings configured in the Fields tab for particular fields. For example, you can override the automatic color palette selected for a particular field to a preferred single color.

You have the following options to select field settings to be overridden:

  • Fields with name: Set properties for a specific field.

  • Fields with name matching regex: Set properties for fields with names matching a regex.

  • Fields with type: Set properties for fields with a specific type (numeric, string, Boolean).

  • Fields returned by query: Set properties for fields from a specific query.