When writing a query, especially if the output is going to be used as part of a widget or visualization, the result may require additional processing to format and update field names, values, formatting, and/or the order of the data.

This processing can be done within LogScale as part of the query, but processing and formatting of this information should be performed after the primary filtering, count, and aggregation has occurred.

For example, given an event set with a list of permissions against a specific filetype, we might use a query like this:

cmd = /.exe$/
| splitString(by=",",field=perms,as=_perms)
| split(_perms)
| groupBy([_perms],function=count(as=_cnt))

This splits up the permissions, aggregates the detail, and then calculates the count of the matching items. The resulting table might look like this:

For displaying as part of a dashboard there are a few issues with this output:

These are all examples of data formatting and finalization that need to be performed as part of the process. LogScale includes functions to modify all of these elements to finalize the data, so that the information is ready to be displayed within a widget or dashboard.

Adding some finalization to the query can tidy it up for display. For example, this query is designed to refine the result:

cmd = /.exe$/
| splitString(by=",",field=perms,as=_perms)
| split(_perms)
| groupBy([_perms],function=count(as=_cnt))
| sort(_cnt,limit=10)
| rename([["_perms","Permission Group"],["_cnt","Count"]])

After the query has concluded, the result looks like this:

This formatting and finalization of the content is a critical part of making the results of a query accessible for use within a widget. For more information, see Widgets.