After upgrade to graylog 3.2 I notice that the option in dashboard to go directly to the log related to a specific counter ( the small play button in the bottom right corner of the widget ) is not there anymore.
It was very convenient and simple way to visualize the cause of a specific counter.
Idea on how to achieve the same in the new dashboard ?
since you can create the widgets for your dashboard directly inside of the dashboard the step back to the search is not necessary anymore. If you want to do a drill down you can do that now directly in the dashboard.
Let’s say you have some kind of chart indicating a attacker and you want to see the messages to it, then I recommend to have a message datatable to your chart (or if not just copy the widget and change it to a datatable) and then:
If this is not what you were searching for let me know and I try to come up with a solution.
I believe that it will do the trick - I need to rebuild my dashboard accordingly.
nice function, but only works for datatable. It would be great to have same function also for another widgets, like piechart, barchart…
yeah I already add it to my feedback list! This should be coming in the next release, depending when we plan to do the next release.
Great, nice to hear. I’m looking forward to next release…
Ok, this is nice with dashboards with one or two widgets. I have dashboard with 12 counters, this is live overview of security related events, it fits in one screen. If some counters seems a little strange, from here I can go directly to data, to see whats going on. On new interface it will be either one large full of data tables which mostly are not needed, or many separate dashboards, for one data counter each. I will lose full overview to get ability to fast analysis. Another place where nicer view is put behind more closed doors.
I also have the same issue - I am using a high amount of counter widgets at the dashboard vor general monitoring of router/switch/mitigation related events. But unfortunatly, without this “little sweet play button” am not comfortable anymore to view the engaged events by clicking and using the partly huge search/filter patterns.
It would appreciate, if you could re-integrate that function.
@d-kun thanks for your input.
We will bring back something like the play button to 3.3. That is sure. I just saw that we have a but that you can’t click
Show Documents for value on a Number Widget (counter). Would that be helpful to have in a patch release?
It will be definitely helpful!
How about the ability to show the documents for the chart or counter or whatever, and able to launch it in a different tab? We got real used to using the play button on the widgets to another tab or window so we could have multiple searches on multiple monitors. When I do the same in 3.2, it simply duplicates the whole dash on another browser tab and not the log messages I just asked for.