view ↗

Use the view stage to customize how your query results are displayed, enabling highlighting, graphing, and column reordering.

Syntax

view highlight fields = <field1>[,<field2>,...] values = <value1>[,<value2>,...]
view graph type = <graph_type> xaxis = <field1> yaxis = <field2> [<optional parameters>] [series = <field3>]
view column order = default | populated

Parameters

Name Type Required Description
highlight keyword No Indicates the view operation is to highlight specific text.
fields string Yes (for highlight) A comma-separated list of fields in which to search for the value to highlight.
values string Yes (for highlight) A comma-separated list of string values to highlight within the specified fields.
graph keyword No Indicates the view operation is to generate a graph.
type string Yes (for graph) Specifies the type of graph (for example, pie, column, area, bubble, line, map, scatter).
xaxis string Yes (for graph) The field to be used for the X-axis. Must be collatable.
yaxis string Yes (for graph) The field to be used for the Y-axis. Must be collatable.
series string No Used for certain graph types (area, bubble, column, line, map, scatter) to group chart results based on this field's values.
column order keyword No Indicates the view operation is to reorder columns.
default keyword No Displays columns in their original order.
populated keyword No Displays columns with the most non-null values first.

Returns

The view stage returns the query results formatted according to the specified visualization or ordering rules.

Usage notes

  • For graph types, the fields specified for xaxis and yaxis must be collatable.
  • The series parameter is available for specific graph types (area, bubble, column, line, map, scatter) to group chart results based on yaxis values.
  • The view column order option applies only to the Query Builder's display and is disregarded in widgets, Correlation Rules, public APIs, reports, and dashboards.

Examples

Example 1: Highlighting specific values

Goal: Highlight the text "successful" wherever it appears within the event_description field.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| view highlight fields = event_description values = "successful"

Explanation: This query will display the records and visually highlight the text "successful" in the event_description column (for example, in "User login successful").

Output:

event_id event_description
101 "User login successful"
102 "File access attempt"
103 "Network connection established"

Example 2: Visualizing categorical data (Pie chart)

Goal: Create a pie chart showing the count of events grouped by their is_successful status.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| comp count() by is_successful as event_count
| view graph type = pie xaxis = is_successful yaxis = event_count

Explanation: This query counts the total number of events for each is_successful status (true or false). The query then displays these counts as a pie chart, where is_successful defines the slices (xaxis) and event_count defines their size (yaxis).

Output:

is_successful event_count
true 7
false 3

Example 3: Trend analysis (column graph)

Goal: Display a column graph showing the count of events per hour.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| bin _time span = 1h
| comp count() as hourly_events by _time
| view graph type = column xaxis = _time yaxis = hourly_events

Explanation: This query groups events into one-hour bins based on _time, counts the hourly_events for each bin, and presents the data as a column graph showing the hourly distribution.

Output:

_time hourly_events
2023-10-26 10:00:00 UTC 9
2023-10-26 11:00:00 UTC 1

Example 4: Adding granularity to graphs (series)

Goal: Show the sum of duration_seconds over time, segmented by is_successful status using a series.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| bin _time span = 1h
| comp sum(duration_seconds) as total_duration by _time, is_successful
| view graph type = column xaxis = _time yaxis = total_duration series = is_successful

Explanation: This query aggregates duration_seconds by hourly _time buckets and is_successful status. The view stage creates a column graph where each hour is represented, segmented by the success status.

Output:

_time is_successful total_duration
2023-10-26 10:00:00 UTC true 39.9
2023-10-26 10:00:00 UTC false 2.95
2023-10-26 11:00:00 UTC true 60.0

Example 5: Prioritizing display (column order)

Goal: Reorder the columns in the results table to display columns with the most non-null values first.

XQL code:

config timeframe = 1d
| dataset = sample_xql_raw
| comp count() as event_count by is_successful
| view column order = populated

Explanation: This query counts events by is_successful and then reorders the resulting columns. Columns that are consistently populated appear earlier in the table view.

Output:

is_successful event_count
true 7
false 3