Hello,
just updated to the 3.2 release but we are a bit lost…
We are using a lot quick values and the ability to chose one field of the quick values in order to include it in the search
With this new release i dont see how to make the same thing
help 
?
Hi @jothoma1,
Thanks for your feedback! We did not implement a default widget like quick values in the 3.2 release.
You have to create a aggregation by hand for now.
I made some explanation here already:
Don’t get confused by the title, I made some explanations around the use of Quick Values shortly later in this thread.
If you have more questions, please let me know.
That was not the best decision, IMHO. This not the only reason but the major one why we will skip version 3.2.
@Karlis I am sorry to hear that, we plan to have default widgets in the future. It would be helpful what other reason are made you to decide to skip the 3.2 release, so we can take this in account for further planning?
Thanks a lot for your feedback!
Main reason as said - no quick values.
Veeeeery slooow comparing to v.3.1.
No possibility to go from dashboard widget to associated search.
Search hints are less helpful, i.e. typing ‘source’ in previous versions gave me field name ‘source:’ (with colon at end) in drop-down menu. I was able to navigate to it using keyboard, hit Enter and immediately type field value. Now the same procedure gives me field name without colon at end, so I should type it first and then field value. Perhaps not big deal, but it was easier before.
No field decorators, we are using Syslog severity mapper for more human readable searches.
Loading saved searches was 2 clicks, now it takes 3 or more clicks.
Load saved searches dialog not remembers how many rows should be displayed, no matter how rows per page I set, nex time there are 5 rows.
At least one positive thing, I like ability to search in dedicated stream easy way.
One note about upgrade procedure - why gl2_accounted_message_size creation was left to post upgrade task, not executed automatically, especially if this can be done in one line.
Hi @Karlis,
thanks for your very valuable feedback!
I want to address some of the issues you described:
No possibility to go from dashboard widget to associated search.
I would say there is no connection anymore between search and dashboard. Since you can create your widget inside the dashboard. In my opinion this gives the dashboards the possibility of a drill down tool.
The search hints will be addressed. I can’t say for sure but I think will be part of the bug fix release.
No field decorators, we are using Syslog severity mapper for more human readable searches.
There they are:
Loading saved searches was 2 clicks, now it takes 3 or more clicks.
Yes it is now 3+ clicks away, but you save much more then only the query. You also save the widgets connected to the query. But I will take that input and have already some ideas to make this better.
Load saved searches dialog not remembers how many rows should be displayed, no matter how rows per page I set, next time there are 5 rows.
We do not save such settings yet. But I guess it is wrong to only display 5 as a default in the first place.
So they are not migrated, OK, got them back.
It sounds like - you have to open 3 doors more now to get in, but you got a better view from your windows now 
Perhaps we need to review our workflow. For me the former was more intuitive and faster to achieve results. Now we need more to prepare before and less improvisation. At least it seems so at first glance.
I guess you are right. The new dashboard needs more preparation but hopefully you will get more results at the same time. Since we are missing default widgets the speed at start is slower. But I like some features like Documents for values or:
Which will highlight a selected value in all message tables and data tables.
Also since you can now have different queries and timeranges per widget in the Dashboard you can have much broader scope in one dashboard.
Hi @konrad,
Just to let you know we were also using a lot the amazing Quick Values function, and we will revert to previous Graylog version to have it back …
(We did read your exchange with @zoulja but the work around doesn’t fulfill our Quick Values loss)
We hope to find back Quick Values in a next release !
That being said, we are very happy to use GrayLog and we really thank you for the work you are doing.
King regards,
Thanks for the feedback @antoine. Every feedback is important!
Soooooooo. I am sorry.
As it seems I lost a bit track of our features. And not just me, but some other peoples as well.
We have something like Quick Values. It is the field action Aggregate:
How many clicks You made to display this? 
Depends on how on what you want to have. If you want the 5 top values. Then one click. If you want some fancy pie graph. Then a couple of clicks more
OK, got it.
Offtopic: Found one more cool feature in 3.2, scratchpad.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
