How-To: Selecting Widgets Based on Query Output

Selecting the right widget for your query results depends on the structure and type of data your query produces. This article helps you identify your query output pattern and choose the most effective widget for visualization.

Note

LogScale automatically disables incompatible widgets based on your query structure.

Identifying Your Data Type

Before selecting a widget, examine the structure of your query output.

The following patterns represent the most common data types and their corresponding widget recommendations.

Time-Based Data

What it looks like: Results include a timestamp or time bucket field with aggregated values over time periods.

Example output:

_bucket              | _count
2024-06-01 10:00:00 | 145
2024-06-01 11:00:00 | 203
2024-06-01 12:00:00 | 178
2024-06-01 13:00:00 | 156

Recommended widgets:

Time Chart Widget → Primary choice for showing trends, patterns, and changes over time.
Heat Map Widget → Shows temporal patterns with intensity, ideal for identifying peak activity times.

Use timeChart() or bucket() functions to prepare data for time-based visualizations.

Categorical Data

What it looks like: Results grouped by categories, labels, or discrete field values with counts or aggregations per category.

Example output:

status_code | _count
200         | 1,245
404         | 89
500         | 23
502         | 5

Recommended widgets:

Bar Chart Widget → Best for comparing quantities across categories visually.
Pie Chart Widget → Shows proportional distribution, works best with 5-7 categories or fewer.
Table Widget → Provides exact numbers with sorting and filtering capabilities.

Use groupBy() and top() functions to create categorical breakdowns.

Flow and Relationship Data

What it looks like: Results showing connections between two entities, such as source and destination pairs, or multi-step sequences.

Example output:

source      | destination      | _count
10.0.1.5    | api.example.com  | 45
10.0.1.8    | db.internal      | 123
10.0.2.10   | api.example.com  | 67

Recommended widget:

Sankey Diagram Widget → Visualizes flows and connections between entities, showing the volume of relationships.

Use sankey() function to prepare source-destination data for flow visualization.

Geographic and Location Data

What it looks like: Results containing IP addresses, country codes, city names, or latitude/longitude coordinates.

Example output:

client_ip     | country | city   | _count
203.0.113.1   | Japan   | Tokyo  | 45
198.51.100.5  | UK      | London | 32
192.0.2.100   | USA     | Boston | 28

Recommended widget:

World Map Widget → Displays events on an interactive map, revealing geographic patterns and distributions.

Use ipLocation() and worldMap() functions to enrich IP addresses with geographic coordinates for mapping.

Single Metric or KPI

What it looks like: Query produces a single aggregated numeric value, such as a total count, average, sum, or percentage.

Example output:

_count
1,247

Recommended widgets:

Single Value Widget → Displays the metric prominently for quick status awareness.
Gauge Widget → Shows the value against defined thresholds with color-coded ranges (healthy, warning, critical).

Use aggregation functions like count(), avg(), or sum() to produce single metric values.

Quick Selection Guidelines

Use the following guidelines when converting table results to widgets:

Time-based data and numerical trends → Time Chart Widget.
Categorical data → Bar Chart Widget / Pie Chart Widget.
Comparisons across categories → Bar Chart Widget.
Proportional distributions → Pie Chart Widget.
Relationships (for example, IP address/port combinations) → Sankey Diagram Widget.
Geographic/location data → World Map Widget.
Key metrics → Single Value Widget / Gauge Widget.
Thresholds → Gauge Widget.

Using Multiple Widgets for the Same Data

The same query results can often be visualized in multiple ways to serve different purposes. For example, categorical data can be shown as:

Bar Chart → For visual comparison of quantities.
Pie Chart → For proportional distribution view.
Table → For exact numbers and detailed analysis.
Single Value → For quick total count overview.

For a detailed example showing one query visualized with five different widget types, see How-To: Visualizing the Same Query With Different Widgets.

Overview of Widget Usage

Selection of widgets depends on the output and type of event set. Remember that Dashboards enable you to visualize the same query results in multiple relevant widget formats.

Table: Overview of Widget Usage

Widget Type	Best Use Cases	Special Notes	Widget Configuration Best Practices
Event List Widget	Real-time monitoring Incident investigation Log analysis Troubleshooting Audit trail review Alert verification Field highlighting Quick filters	Optimized for chronological event monitoring and investigation. (Key difference between Event List and Table).	Time format configuration Field selection/ordering Color coding by severity Auto-refresh settings Event expansion options
Table Widget	Aggregated statistics Comparison of metrics Summary reports Top N analysis Pattern analysis Metric comparisons	Better for structured, aggregated data presentation. (Key difference between Event List and Table).	Sortable columns Time formatting Color coding Export capability Drill-down links
Scatter Chart Widget	Investigating correlations Finding anomalies Visualizing distribution patterns Analyzing paired metrics Identifying clusters of related events	Best for showing relationships between variables.	Axis scaling Point size/color mapping Opacity settings Trend line options Outlier handling
Pie Chart Widget	Part-to-whole relationships Proportional distributions Percentage breakdowns Limited categories (ideally 5-7 max) When total equals 100%	Not recommended for: Comparing values across time (use Time Chart) Many categories (use Bar Chart) Similar-sized segments (use Bar Chart) Precise value comparisons Complex relationships (use Sankey Diagram)	Limited segments (5-7 max) Clear segment labels Percentage display Consistent colors Donut variant option
Bar Chart Widget	Comparing quantities across categories Ranking data (Top N analysis) Showing frequency distributions Time-based comparisons Multiple category comparisons	Best for comparing quantities across categories.	Horizontal orientation for long hostnames Color coding by severity Clear axis labels Click-through capability
Heat Map Widget	Temporal patterns visualization Density distributions Pattern recognition over time Activity concentration analysis Multi-dimensional data representation Intensity mapping	Best for showing patterns and density over time.	Appropriate color scheme Clear legend Time-based patterns
World Map Widget	Geographic distribution of events Attack origin visualization Traffic flow patterns Regional activity monitoring Location-based analysis Global service monitoring	Best for geographical data visualization.	Location mapping Clustering options Color scheme for values
Single Value Widget	Key Performance Indicators (KPIs) Critical metrics display Status indicators Summary statistics Threshold monitoring Real-time counters	Best for KPIs and critical metrics.	Trend indicators Threshold colors Comparison with previous period Clear formatting
Sankey Diagram Widget	Flow visualization Network traffic patterns Process flows Data transformation paths Resource allocation Relationship mapping	Best for showing flow relationships.	Clear flow direction Node coloring Link thickness scaling Node ordering Label placement
Gauge Widget	Real-time updates Threshold markers Custom ranges Alert colors	Best for showing values against thresholds.	Clear thresholds Color ranges Min/max values Unit display Needle animation

Additional Resources

For more information about widgets and visualization, see:

Step-by-Step Guide to Dashboards → Step-by-step guide to creating dashboards.
Widgets Gallery → Gallery of all available widget types for inspiration.
Widgets → Complete widget documentation.
Widget Query Functions → Widget-specific query functions.
Dashboards → Dashboard creation and organization.
How-To: Visualizing the Same Query With Different Widgets → Example showing one query with five widget types.
How-To: Dashboard Design Best Practices and Templates → Best practices and templates for designing effective dashboards.

Versions of this Page

Guidance