Query Comparison Chart

The Query Comparison chart is a multiple-query metric that shows the number of results (number of entities) for each selected query.

To configure a Query Comparison chart

2. You can add a description if you want.
   3. From the Widget dropdown, select Query Comparison Chart.
   4. Select the chart visualization type: Bar, Pie, or Table.
   5. Add queries to compare:
3. Do one of the following:
   • Click Add query to add a query without an asset module selected.
   • From the dropdown list, click Add "asset" query and select a query type that includes the asset module. The Add query button lists the name of the asset module selected so that the next time a query is added it will automatically select the same module. To add a query from a different module, select it from the dropdown list.
4. Select a query from the Query list or click Add query to create a new query. Learn more about creating a query.
5. Add more queries if needed.
6. When you choose bar chart or a table, define the default data sort. By default, the data is sorted by descending values. You can choose to sort by name, value, Query order, or percentage. Percentage is available when you compare results to a previous date. With percentage in descending order, the queries with the largest increase since the comparison date appear first. You can rearrange the query order by dragging queries to your preferred position. When you rearrange queries, the chart sorting automatically switches to Query order.
   As you configure the chart, a preview is created in the left pane.
7. You can also:
   • Assign chart colors to asset count thresholds to easily evaluate the current environment. In the Table view, select Static or Dynamic thresholds. See Setting Threshold Colors.
   • In bar and pie charts, compare today's query results to a previous date. See Comparing Today's Query Results to a Previous Date.
   • In bar charts, set the value that fills the full width of a bar. See Setting the Bar Axis Maximum.
   • Set the chart to display results from a relative or fixed historical date. See Viewing Query Results from a Historical Date.
     When you create a bar chart, by default, the top 5 results are displayed. Use the pagination button to view the rest of the results.
     Bar chart example
     
     Pie chart example
     

Showing Asset Investigation Events

Use a Query Comparison chart to compare the number of field change events of saved Asset Investigation queries.

Permissions: To add or edit a chart, you need the Dashboards > Charts > Add or Dashboards > Charts > Edit permission. You also need the Asset Investigation > View permission. A user inside a data scope sees an empty chart.

To compare Asset Investigation events:

1. On the Asset Investigation page of an asset type, save the queries you want. See Asset Investigation.
2. On a dashboard, click Add Chart and select Query Comparison Chart.
3. For each query, select the module Asset Investigation - and a saved query of that module.
4. Select a view.
5. Click Save.

• Each bar or slice shows the number of events of one saved query. An empty query selects all the events.
• You can mix Asset Investigation queries with asset queries in one chart.
• The chart always shows the current events. Historical date and net change aren't available for these modules.
• When you click a bar, the Asset Investigation page opens with the filters of the saved query.

Example: Save the Asset Investigation queries "OS changes" and "Agent changes" on Devices. Create a Query Comparison chart with both queries to compare the number of events of each type.