Skip to content

Event List

The Event List dashboard panel is used for displaying an event list in an Dashboard. Different filter types can be used when displaying the data, and different options include:

  • Displaying events that match a pre-defined event Filters.

  • Displaying all events for a specific Device.

  • Displaying all events for devices that have a specific Meta Type/Tag combination.

  • Displaying events that match a custom search query using a Transient Event List.

  • Displaying events that match a custom search query using a Forensic Event List.

Form Fields

  • Panel Name - Name of the panel to be displayed in the panel header.

  • Display - The Event Display that will be used when displaying the event list.

  • Filter Type - The filter type that will be used when displaying the data.

  • Filter Group - If Filter Type is set to "Event Filter", the Filter Groups can be traversed so restriction filter(s) are applied to the search query.

  • Filter Name - If Filter Type is set to "Event Filter", the Event Filter that will be used to retrieve events.

  • DeviceName - If Filter Type is set to "Device", events for the selected Device will be displayed.

  • Meta Type - If Filter Type is set to "Meta Tag", events for devices with the Meta Type and Tag combination will be retrieved.

  • Meta Tag - If Filter Type is set to "Meta Tag", events for devices with the Meta Type and Tag combination will be retrieved.

  • Where - If Filter Type is set to "Transient Event List", the custom SQL-based WHERE clause that will be used to retrieve events.

  • View Options - If Filter Type is set to "Forensic Event List", this will control the fields that are shown for filtering.

    • If Standard is selected, only the fields in the selected Display will be shown.

    • If Advanced is selected, all fields from the Events table will be displayed.

  • Display Conversions - If Filter Type is set to "Forensic Event List", whether to show converted values.

    • If Use Display is selected, use selected Display's setting for conversions.

    • If On is set, enables display conversions regardless of display setting.

    • If Off is set, disables all display conversions from form selection and event list regardless of display setting.

  • Sort - If Filter Type is set to "Forensic Event List", how to sort the event list.

    • Choose Frequency to sort the results first by the Severity field (higher Severity is on top), then by the Count field (higher number of Events is on top).

    • Choose AlphaNumeric to apply the sort to the Summary field.

  • Typeahead Only - If Filter Type is set to "Forensic Event List" and checked, this will prevent loading all available options until a query of 4 or more characters are entered. This should be checked in large scale systems when the option queries frequently timeout.

  • Fields - If Filter Type is set to "Forensic Event List", the fields from the Events table will be displayed, depending upon the View Options selected.

  • Show Toolbar - Whether or not to show the toolbar, which contains the Pause and Select All buttons, the Display selector, and the Filter Group and Filter selectors.

  • Show Severity - Whether or not to show the severity toolbar, which provides a quick way to limit the results based on severity.

  • Show Paging Toolbar - Whether or not to show the paging toolbar, which contains pagination controls, the Refresh button and results counter.

  • Hide Header - Whether or not the panel header should be shown.

  • Width - Limit the panel to a specific percent width of the dashboard, ranging from 0.01 to 1.

  • Auto Height - Whether or not the panel should automatically increase in height to show all data available.

  • Height - If Auto Height is not checked, limit the panel to a specific height in pixels.

  • Paging Limit - The default pagination amount.

  • Refresh Rate (secs) - How often the data within the event list should be updated.

Grid Details

Besides the event list itself, the grid can contain various controls that are specific to displaying and interacting with the event list.

  • If Show Toolbar is enabled, a button bar with the following controls will be displayed:

    • Click the Pause button to stop the event list from automatically refreshing. When Pause is activated, click the button again to refresh the event list.

    • Click the Select all button to select all of the current visible events in the event list.

    • The Display selector allows users to change what fields are visible in the events list.

    • The Filter Group selector allows users to change what filters can be used, while also utilizing restriction filter(s).

    • The Filter selector allows users to change what filter is used.

  • If Show Severity is enabled, the severity quick-select toolbar is displayed, which provides a quick way to limit the results based on severity.

  • If Show Paging Toolbar is enabled, the pagination controls will be visible and can be used to go through the event list. Pagination controls include the following:

    • Back to Page 1

    • Back 1 Page

    • Page Selector

    • Items per Page Limiter

    • Forward 1 Page

    • Forward to Last Page

    • Refresh Results

    • Results Counter

Best Practices

The Forensic Properties options may not load for events if your Events table gets larger than 1 million records. To get the options to load as quickly as possible, set the Sort method to "AlphaNumeric". Also, fields that are bold are indexed and will typically load much faster. If there are fields that will not load but are necessary for your use, adding an index to the field may alleviate the problem. You can also just type in the value you need to filter by if you know it. You do not have to select it from the list.

Back