Field Summary Chart

The Field Summary chart is a single query metric, consisting of a single query and a chosen field. Use this chart to present the calculated outcome (average, count, count true, count false, sum, maximum, minimum) on the values of the chosen field across the dataset given by the query. You can choose to display data either as a chart or as a timeline chart. You can use the timeline chart to track the values of a field over time.

When all required fields are configured, a preview of the chart is displayed in the preview pane to the right. You can click on a chart segment to view a list of related assets in an asset page table. The columns of the table are updated to match the chart configuration.

To configure a Field Summary chart:

1. In the Chart title text box, enter a title for the chart.
2. In the Description text box, you can add an optional description.
3. From the Widget list, select Field Summary Chart.
4. Chart presentation – Select the chart presentation, bar chart, gauge, or timeline view. See Using the Gauge View.
5. Chart Description – Specify a chart description type: Default, Empty, or Custom. If you choose 'Custom', type a value of up to 250 characters.
6. From the Module list, select an asset module.
7. From the Query list, select or create a base query or leave empty for all entities. Learn more about creating a query.
8. Text color – Select the color of the text to display.
9. Select a field to run the function.
   • The available functions are based on the type of the field you select and vice versa. The fields available depend on the module you select.
   • If you chose the Average or Sum function, you can select only integer type fields.
   • If you chose the Count function, you can select all the fields except Boolean type fields.
   • If you chose a Count True or Count False function, you can select only Boolean type fields.
   • If you chose the Maximum or Minimum function, you can select only number and date type fields.
   • To measure a field of a related asset, select the field with Field from. See Using Fields of Related Assets in Charts.
10. Select a function to calculate:
    • Average
    • Count
    • Count True
    • Count False
    • Sum - Learn how the Sum function works in charts.
    • Maximum - Shows the highest value of the field. See Showing the Highest or Lowest Value.
    • Minimum - Shows the lowest value of the field. See Showing the Highest or Lowest Value.
11. Number format – Set the number format for the display:

• Float (default)
• Ceiling – round the value up to the next integer
• Floor – round the value down to the preceding integer
• Round – round the number according to rounding rules when the value is < .5 - Round down, when the value is > .5 - Round up

To show large numbers in a compact form, see Showing Large Numbers in Short Notation. You can also show Yes or No in place of a number. See Showing Yes or No.

12. Timeline Settings - When you choose timeline view, set the following:

    • In Aggregate by, select an aggregation time period: Day, Week, Month Quarter, or Year. Query results for weekly, monthly, quarterly, and yearly time periods are aggregated based on the average values for the selected time period. Each data point for weekly aggregation is the average of all daily values since the last weekly period. And each data point for the monthly aggregation is the average of all daily values since the last monthly period. You can choose to exclude date ranges from the displayed range. The legend reflects the time period selected.

      Note

      On the daily aggregation chart, you can click through to the asset list. See Selecting a Table View for more on what data is displayed when you click a chart segment.

      
      

    • Set one of the following:
      • Show results in the last x days – select a number and a time period, days, weeks, months or years.
      • Or show results in date range – Set a start and end date.
        In the graph that is created when you click on a point in the graph it opens the query in the Devices page.

13. You can also:

    • Assign chart colors to asset count thresholds to easily evaluate the current environment. See Setting Threshold Colors.
    • Compare today's query results to a previous date. See Comparing Today's Query Results to a Previous Date.

14. Click Save.

Showing the Highest or Lowest Value

Use the Maximum and Minimum functions to show the single highest or lowest value of a number or date field across the assets of the query. For example, show the oldest Last Seen date of a group of servers.

Permissions: To add a chart, you need the Dashboards > Charts > Add permission. To edit a chart, you need the Dashboards > Charts > Edit permission.

To show the highest or lowest value:

1. On a dashboard, click Add Chart.
2. From the Widget list, select Field Summary Chart.
3. Select the asset module and the query. To use all assets, leave the query empty.
4. Select a number field or a date field.
5. From the function list, select Maximum or Minimum.
6. Click Save.

• Maximum shows the highest value of the field across the assets of the query. Minimum shows the lowest value.
• The functions are available for number fields and date fields only. When you select the function first, the field list shows only these fields.
• For a date field, the chart shows the date in the date format of the system.
• When an asset has more than one value, for example from more than one adapter or in a list field, each value counts.
• The default chart description is "maximum of on results", or "minimum of on results".
• The functions are available for the single-value chart only. They aren't available for the timeline view or for a Pivot chart measure. If you change the chart to the timeline view, Axonius clears the function.
• Show as Yes / No isn't available for Maximum and Minimum.
• When the chart compares the value to an earlier date, a date value has no net change. A number value has no net change when either date has no value.
• When you click the chart, the asset page shows the assets of the query that have a value in the field.

Example: Add a Field Summary chart on the query "Windows servers" with the field Last Seen and the function Minimum. The chart shows the oldest Last Seen date of these servers, so you can find the server that Axonius didn't see for the longest time.

Showing Large Numbers in Short Notation

Use Use short notation K/M/B to show large numbers in a compact form, for example when the number is too wide for a small chart.

Permissions: To edit a chart, you need the Dashboards > Charts > Edit permission.

To show a number in short notation:

1. On a dashboard, open the menu of a Field Summary chart and click Edit.
2. Below Number format, enable Use short notation K/M/B.
3. Click Save.

• By default, this option is disabled, and the chart shows the full number with thousands separators, for example 15,143,458.
• When this option is enabled, a value of 1,000 or more appears with K (thousands), M (millions), or B (billions) and one decimal at most. For example, 15,143,458 appears as 15.1M, and 14,336 appears as 14.3K. Values under 1,000 don't change.
• Axonius applies Number format first, and then the short notation. For example, 2,499,999.6 with Round appears as 2.5M.
• The option doesn't change the Maximum or Minimum of a date field, or a chart that uses Show as Yes / No.
• The option is available for the Summary and Gauge views. It isn't available for the timeline view.
• The option changes only how the number looks. The chart data doesn't change.

Example: A Field Summary chart shows the Sum of a number field: 15,143,458. Enable Use short notation K/M/B. The chart now shows 15.1M.

Showing Yes or No

Use Show as Yes / No to show Yes or No in place of the number, for example to show whether an asset matches the query on an asset profile dashboard. The option is available for Field Summary charts on all dashboards, and for the Summary and Gauge views of the Pivot chart.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission.

To show Yes or No:

1. Open the dashboard, and add a Field Summary chart or edit one.
2. Select the module, the query, and the field.
3. Select a function other than Maximum or Minimum, for example Count.
4. Enable Show as Yes / No. The option is below Number format and Use short notation K/M/B.
5. Click Save.

• By default, this option is disabled, and the chart shows the number.
• When this option is enabled, the chart shows Yes when the value is more than 0, and No when the value is 0.
• On an asset profile, the chart calculates for the one asset of the profile. Yes means that the asset matches the query and field.
• On other dashboards, Yes means that the value is more than 0.
• The option isn't available for the timeline view, or for the Maximum and Minimum functions. When you change the function to Maximum or Minimum, Axonius clears the option.
• Threshold colors still use the number, 1 or 0, and not the text.

Example: On the asset profile dashboard of devices, add a Field Summary chart with the function Count and the query "Devices with an EDR agent". Enable Show as Yes / No. For each device, the chart shows Yes when the device has an EDR agent, and No when it doesn't.

Using the Gauge View

Use the Gauge view to show a single value on a half-circle arc, for example a score between 0 and 100.

Permissions: To add a chart, you need the Dashboards > Charts > Add permission. To edit a chart, you need the Dashboards > Charts > Edit permission.

To configure a Gauge chart:

1. On a dashboard, click Add Chart.
2. From the Widget list, select Field Summary Chart.
3. Select the Gauge view.
4. Select a module, a query (optional), a field, and a function.
5. In Minimum and Maximum, enter the two ends of the arc.
6. (Optional) Enable Lower is better.
7. (Optional) Enable Set threshold colors and set the ranges. See Setting Threshold Colors.
8. Click Save.

• The arc shows Minimum at the left end and Maximum at the right end. The two numbers appear under the ends of the arc.
• Minimum is 0 and Maximum is 100 until you change them. You can enter any number, including negative numbers and decimals.
• Maximum must be greater than Minimum. Otherwise, the message "Maximum must be greater than Minimum" appears and you can't save the chart.
• By default, the arc fills from Minimum up to the value. When you enable Lower is better, the arc fills from Maximum down to the value, so a lower value gives a fuller arc. Minimum stays on the left.
• A value below Minimum or above Maximum fills the arc to its end. The chart still shows the true value.
• The arc and the value use the chart color. When you set threshold colors, they use the color of the range that contains the value.
• The value uses the same number format, description, and net change as the Summary view. Use short notation K/M/B also applies.
• Show 0 when there is no data applies to the Gauge view.
• When you click the Gauge, the asset page shows the same assets as for the Summary view.
• Reports show the Gauge as the dashboard shows it.
• The Gauge view isn't available for Field Summary charts on Asset Investigation modules.

Example: A Field Summary chart of devices on a risk score field from 0 to 100, with the function Average. Keep Minimum at 0 and Maximum at 100, and enable Lower is better. Set threshold colors: green for 0-40, yellow for 40-70, and red for 70-100. A lower average risk gives a fuller green arc.

Showing Asset Investigation Events

Use a Field Summary chart to count the field change events of a saved Asset Investigation query.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission. You also need the Asset Investigation > View permission. A user inside a data scope sees an empty chart.

To count Asset Investigation events:

1. On the Asset Investigation page of an asset type, save a query that selects the events you want. See Asset Investigation.
2. On a dashboard, click Add Chart and select Field Summary Chart.
3. Select the module Asset Investigation - and the saved query.
4. Select a field. The function is always Count.
5. Click Save.

• The chart counts the events that have a value in the selected field. An empty query selects all the events.
• Only the Summary view is available.
• The chart always shows the current events. Historical date and net change aren't available.
• When you click the chart, the Asset Investigation page opens with the filters of the saved query.

Example: Save an Asset Investigation query "OS changes, last 7 days" on Devices. Add a Field Summary chart on this query to show the number of changes.

The Sum Function in Charts

The sum function is designed to handle aggregated fields (i.e., fields with multiple numeric values) to ensure accurate aggregation. The sum function calculates the average of aggregated values within a specific field, and only after that sums the fields. This method allows for more meaningful aggregation, especially when dealing with complex datasets where fields can have varying numbers of values (i.e., 'Free RAM').

The following describes in detail how the system calculates the sum:

1. The system calculates the average of nested values. For each asset, if a field contains multiple numeric values, the system first calculates the average of these values.
2. The system then sums these averaged values (i.e., the average for each field with multiple values) across all relevant assets.

The following example shows how sum works on an aggregated field.

Example

Consider three assets with a field Field A containing the following nested values:

• Asset 1: Field A = [10, 20, 30]
• Asset 2: Field A = [5, 15, 25]
• Asset 3: Field A = [12, 18, 24]

The system calculates the sum of Field A in these three assets as follows:

1. Calculates averages in the three assets:

   • Asset 1: Average of Field A = (10 + 20 + 30) / 3 = 20
   • Asset 2: Average of Field A = (5 + 15 + 25) / 3 = 15
   • Asset 3: Average of Field A = (12 + 18 + 24) / 3 = 18

2. Adds the averages.

   • Sum of Field A across the three assets = 20 (Asset 1) + 15 (Asset 2) + 18 (Asset 3) = 53

Viewing a List of Assets Represented by the Chart

Once the chart configuration is saved and it has been populated with data, you can click the chart to see a list of the assets represented by it in one of the asset pages. The query configured in the chart is populated into the query bar above the list and into the Query Wizard.

Examples

For example, the number of Windows OS type devices on the system and the average RAM usage across all devices for last scan. Click on the value to open the query in the devices page.

For example, the average of total RAM on devices see in the last 7 days. Mouse over to see the values on each point. Click on a data point to open the query on the devices page.