Falcon LogScale Documentation

When you use the timeChart() function in one of your queries, it creates one or more time-series based on the event data fed into the function. Time-series data can easily be plotted as graphs in Grafana by using the Graph panel type, which can be seen below.

Figure 371. Time Series Graphs

This specific panel showcases the number of incoming connections over time across different hosts in a network. It was created by querying a Humio repository filled with Windows logs, coming from different Windows PCs on the same network. The query used can be seen below. It filters for all events that indicate a network connection, and then pipes those into timeChart(), generating a time series for each unique hostname discovered in the filtered events.

event.action = "Network connection detected (rule: NetworkConnect)" |
timechart(series=host.name)

Like in the Humio UI, you are able to zoom into specific parts of your graph in Grafana, and you may plot multiple time-series from multiple different queries on the same panel.

Humio supports the use of the groupBy() function in its queries, following the same concept as the GROUP BY found in SQL. The grouped data can be visualized using Grafana's Bar Gauge panel type, as shown below.

Figure 372. Bar Gauges

This specific panel is generated from a HaProxy server, which sits in front of a Humio instance. It shows the average number of bytes read per Humio query job, created on that particular Humio instance. The query used to create the panel can be seen below. As the logs from HaProxy only leave details about web requests, we have to use Humio's regex feature to filter for the events, which describe a web requesting polling from a query job. These events are then grouped by query job, summing up the number of bytes read from the job. Finally the data is grouped across the different repos on the Humio instance.

method=GET |
"status_code"=200 |
regex("/api/v1/dataspaces/(?<refdomain>.+?)/queryjobs/1-(?<jobId>.{24})",field=path) |
groupby([refdomain, jobId],  function=sum(bytes_read)) |
groupby(refdomain, function=avg(_sum))

As with all other Grafana panels, the Bar Gauge panel is visually customizable, and you can change its look and feel by editing the settings of the panel. In this example we have chosen a retro LCD look for each of our gauges.

Humio generates tabular data, when the table() function is used within a query. Naturally, this type of data can be displayed in Grafana's Table panel type, as shown below. As a neat feature, if you do not want to use the header names generated by the query, Grafana allows you to change them through the Grafana UI.

Figure 373. Grafana Tables

This particular panel was created from the query below, which looks at Windows logs in a Humio repository. First, we use filters to get a hold of all the unsuccessful login attempts. Afterwards we group the logons by username before finally piping the grouped data into the aforementioned table() function.

winlog.task = Logon |
winlog.keywords[0] = "Audit Failure" |
groupby(winlog.event_data.TargetUserName) |
table([_count, winlog.event_data.TargetUserName], sortby=_count, limit=5)

While some queries produce very simple results, they can still be very useful. As an example, take queries that use the count() function, which only returns a single number. When displaying this in a Singlestat panel, as shown below, you can add thresholds values. Now each time the value breaks a threshold the panel will change color.

Figure 374. Grafana Single Stats

Again, this panel has been populated by querying a Humio repo filled with Windows logs. It uses a few filters to get all unsuccessful login attempts, and then pipes these into count().

winlog.task = Logon  |
winlog.keywords[0] = "Audit Failure"  |
count()

Humio has a great feature in the worldMap() function, which can take input from log events, such as IP addresses, and map them into a data format that can be visualized on a map.

While Grafana doesn't have a native Worldmap panel, there is a third party Worldmap plugin. This can be combined with the Humio plugin to showcase locational data on your Grafana dashboard, as shown below.

Figure 375. Grafana Worldmap

The query to create this panel was very simple. It only required us to filter on http events and then pipe those into the worldMap() function.

type=http | worldmap(ip=client_ip)

Please note that in order to get the results shown on the panel above, you will need to configure the panel a bit. This is however covered in our Grafana.