Configuring a Pivot Chart with Line Visualization

Use the Pivot chart Line visualization to create timeline charts that track trends and changes over time. Line charts display data points connected by lines to help you identify patterns, trends, and anomalies in your asset or activity data.

Line charts can be configured in three ways:

• Single line - Display a single trend line based on aggregated data from a single metric.
• Multi-line -
  • Multi-line with dimension segmentation - Create multiple lines to compare trends across different categories such as OS type, asset status, user, or activity type. Each unique value in your selected dimension creates a separate line.
  • Multi-line with multi-measure comparison - Display multiple metrics on the same timeline to compare different measurements.

📘

Note

When creating multi-line charts, you can segment by dimension or use multiple measures, but not both at the same time. See Configuring Multi-Line Timeline Pivot Charts.

Understanding Schema Options

When configuring a line chart, the Schema option determines whether the chart uses current data or historical snapshots:

• Latest Data - Uses data from the latest fetch. The chart aggregates data by a date field you select (such as "Last Seen" or "Created").
• Data over time (snapshots) - Uses historical snapshots to show how data changes across multiple points in time. This option is only available for asset modules.

Modules with Limited Schema Options

Some modules don't support historical snapshots. For these modules, only the Latest Data option is available:

• Adapter Fetch History - Track adapter fetch activity, devices fetched, and fetch status over time
• Activity Logs - Track user and system activities, audit changes, and system events over time
• Audit - Monitor system and user audit events
• Security Findings - Track findings data over time

When you select these modules, the chart automatically uses Latest Data with a date field you select for the x-axis.

Configuring a Line Chart

This describes how to configure a single-line chart. To configure a multi-line chart, see Configuring Multi-Line Timeline Pivot Charts.

To configure a basic line chart:

1. On any editable dashboard, click Add Chart or edit an existing chart.

2. In the Name field, enter a descriptive name for the chart.

3. From the Widget list, select Pivot Chart.

4. Under Visualization, select Line.

5. Under Data, select a module and query that filters the data you want to track.

6. If the selected module supports multiple schema options, under Schema, select your preferred data source:

   • Latest Data - Uses current data, aggregated by a date field you select
   • Data over time (snapshots) - Uses historical snapshots (asset modules only)

7. Under Dimension Column, select the time field for the x-axis:

   • Select a date field such as Start Time, Last Seen, Created, or Date
   • Click the edit icon to configure time aggregation (Day, Week, Month, Quarter, or Year)

8. Under Dimension Row (optional):

   • Leave empty for a single trend line

9. Under Metrics, select the field and calculation function:

   • Count - Count the number of events
   • Sum - Total of values
   • Average - Calculate average values
   • Median - Calculate the median value

10. Configure Calculation and Presentation settings, then click Save.

Working with Line Charts

Once you create the chart:

• Hover over data points - View detailed information in a tooltip
• Click on data points - Open the relevant module page filtered to show the specific events
• Export to CSV - Select Export to CSV from the chart menu

Examples

Example 1: Single Line Chart - Total Adapter Fetch Count

Track the total number of adapter fetch events over time using Adapter Fetch History. This module uses Latest Data only.

1. Create a line chart named "Total Adapter Fetches - 30 Days"
2. Select Adapter Fetch History as the module
3. Under Dimension Column, select Start Time with Day aggregation
4. Leave Dimension Row empty (for a single line)
5. Under Metrics, select a count field with Count function
6. Set calculation to show the last 30 days
7. Save the chart

The chart displays a single line showing the total number of fetch events per day over 30 days.