Logscape Support

Members Login
Post Info TOPIC: Idea: URL Linking


Member

Status: Offline
Posts: 21
Date:
Idea: URL Linking
Permalink  
 


1 suggestion on the linking, is allow whole queries / templates to be pasted in the URL, these automatically get prefixed to all panels such as

 http://Logscape:8080/play/?Workspace=Security&filter=&query1=stintf.equals(wan1)&query2=type.equals(traffic)

 This could then be used in the search, by adding a “special function”

  •  *| _tag.equals(fortigate)  query.include(query1, query2)

 Which results in

  •  *| _tag.equals(fortigate)  stintf.equals(wan1) type.equals(traffic)


__________________


Veteran Member

Status: Offline
Posts: 45
Date:
Permalink  
 

Have you looked at the Workspace Linking feature? You  can currently achieve most of that functionality using a combination of Workspace linking and Saved searches. Especially in version 3.03 where fixing URL links in the HTML is a lot more consistent.
You can build a HTML menu on the left which simply loads the same page with different filters (UAT/PROD/DMZ) for example

This works particularly well with the variable discovery feature -  http://logscape.github.io/workspaces-linking.html

I don't think you'd want to force a whole search query(as opposed to a filter) onto an entire Workspace: then all your graph widgets would produce the same graphs.

I quite like the idea of user functions though - a little like shortcuts for commonly used filters and searches - which would be a logical extension to the new Search navigation. Some possible implementation routes:

 

1. User Specified - User uploads a Functions.properties file to the environment in a format like this

Function1=Network.equals(Wan)
Function2=Zone.include(EU)

Then at search, user could call them in some such manner _userfunction.equals(Function1)

Essentially riffing the idea off the Grokit fields. Probably simple to implement - not very elegant though and requires Admin rights to alter. However does ensure that an efficient admin sets things up. 

2. Search History - Keep a drop down record of recent and popular searches. Allows user to repeat previous, also copy and paste. (I like this idea anyway as it means you can recall what you last did!)

3. Variable Discovery - Currently this feature (as mentioned above) only works for the html elements. You could look at implementing them into searches - however, I suspect that would be very tricky as the search is loaded before/at the same time as the workspace. 

4. Popular Search Combinations - A slightly advanced version of 2. Show the most recent and most popular filter functions and their combinations. First, ensure Logscape tracks the use of .exclude .include .equals .exclude functions. Then, on clicking the drop down, show the last 5 and the 5 most popular uses of those functions - by User Group. So for example, if users in my group always use Network.equals(wan), that should appear near the top of the pile. 

If you wanted to go overboard, you could track the use of all functions and have suggestions for all of them along those lines. But the filters would be the best starting point



__________________

Excelian - GitHub



Member

Status: Offline
Posts: 21
Date:
Permalink  
 

I'm gonna start working for the Linked-worked spaces, but I think allowing more than 1 parameter to be filtered would allow a lot more functionality, for example if I want to drill down into Firewall traffic -

1) Workspace One - Shows Firewall bandwidth usage across our different sites, Select a specific Firewall to drill down into to see User details
2) Workspace Two - Shows bandwidth used on that Firewall aggregated by User, select a specific User to drill down into to see Application details
3) Workspace Three - Shows Application data for a User on on a Specific Firewall (to get this far you need multiple URL attributes, including the Firewall and Username).

Cheers



-- Edited by kelv1n on Friday 4th of December 2015 04:25:18 PM

__________________


Member

Status: Offline
Posts: 21
Date:
Permalink  
 

Another idea I'd chuck in the mix, is a Filter-bar.

Basically a HTML bar, with a bank of dynamic dropdowns, the contents of the dropdown is generated from queries.

An example along the Firewall-related Workspaces I'm working on, they would have a filter-bar with dropdowns for Network Interfaces, Users, Applications etc.

Each filter would have 3 editable components

1) Name / Label
2) Query to generate content
3) filterAction value (or how the filter is applied)

__________________


Veteran Member

Status: Offline
Posts: 45
Date:
Permalink  
 

You can pass through multiple parameters. For example:

?Workspace=Test&name=Chris&age=15

Will populate the Test workspace if you use the following html:

Hi $name you are $age

You can use those for the filters, amendments etc.

What that does mean is that your Workspace linking has to include the previously collected parameters - so in workspace 1, you collect the Firewall, in workspace two you collect the user and pass through the Firewall. It makes the linking a little more complex, but it does work!


The drop downs are a nice idea. You can currently use the Workspace linking tables (in combination with multiple parameters) to provide a dynamic menu - that's how the HPC Server App Navigation works. You could of course use HTML widget to populate a drop down; but that data would be static: so suitable for firewalls perhaps but not users. Of course - you run some risks affecting the user experience if you dynamically populated a drop down with 50+ options - both in performance and use.

Mind you, with 3.03 improved indexing, perhaps something along the lines of the top 5 / top 10 would be fairly simple to implement.


__________________

Excelian - GitHub



Member

Status: Offline
Posts: 21
Date:
Permalink  
 

Few questions on the URL linking -

1) How would you use the "age=15&name=chris" in search queries in the panel? I saw references elsewhere to be able to specify some kind of parameters with {1} etc, but it was from 2-3 years ago.
2) Is it possible to specify time addributes on the URL? For example ?workspace=Firewalls&timeframe=4h - this would tell the workspace to show the past 4h's data.

I've not looked at the HPC App yet, but will do soon as I want to start logging from our Windows environment.



-- Edited by kelv1n on Wednesday 9th of December 2015 10:42:03 PM

__________________


Veteran Member

Status: Offline
Posts: 45
Date:
Permalink  
 

1. You don't use it to amend the search, you use it to filter it. 

So we have the following Example Data:

User:John Server:Box1 Application:Word

User:Clive Server:Box1 Application:Excel

User:James Server:Box2 Application:Excel

My workspace has 2 tables:

* | Application.count(Server) chart(table) buckets(1)

* | User.count(Server) chart(tables) buckets(1)

Both could use the following table linking:

{ column: 'Server',   url: '?Workspace=THEWORKSPACENAME&filter=$value&filterAction=Server.equals', filterColumn: 'Server'    }

This would turn the server column into a hyperlink, that refers to the same Workspace but this time applying the filter. 

If you think about it, this makes more sense - the search string cannot depend on a filter or variable - if it did then the first time you visited without a valid variable, it would break. Instead you filters on the searches which narrow down what you need.

One gotcha to remember!

Imagine if my workspace linking was filtering on Application rather than User. Table 1 would still be filtered and work correctly - but Table 2 doesn't have Application data in the table and would be left blank.

What this shows is that you need to think through your Workspace design - essentially, try to consistently group Workspaces by what you intend to filter. If it's a server based workspace, break all the charts/tables by server and have your filters reflect accordingly. Again, if you look at the Unix, Windows and HPC Apps, they all have workspaces on those principles - so that the filtering works cleanly. 

2. Not at present - because the Workspace is independent of the time searched. So the same URL could be used to span 5 minutes or a week. If you enforced that, changing the time in the GUI would break the URL link. 

However, when you save a Workspace, it does remember the timespan you've set. So if you are doing a reporting space, save it when it's set to last 7 days and that should be the default time span allocated. 

Mind you, setting the time is pretty trivial. The real question is - are there time spans missing from the drop down you'd like



__________________

Excelian - GitHub



Member

Status: Offline
Posts: 21
Date:
Permalink  
 

Thanks for the follow up -

1) Allowing URL parameters into the search query for panels would add flexibility -

  • query1=name.equals(jon)&query2=application.equals(Excel)

I don't think it would necessarily break things, as it could work similar to filter and filterAction, which is only populated when present.  Where workspaces are built specifically to work with these, then that is the decision of the Workspace designer. But it could work similar to filter and filterAction. Perhaps the best way to achieve this is allow multiple entries for filter and filterAction, such as

  • filter1=Jon&filterAction1=name.equals

 



__________________


Senior Member

Status: Offline
Posts: 102
Date:
Permalink  
 

We will revisit workflow linking in the very near future. It was initial bought in as a way to instantly remove noise from charts (without re-running the search). Linking from tables also allows them to be data-driven which makes some of the apps very powerful!

Since then our thinking (and customers) has evolved; we will use this input to make it more flexible and powerful.


__________________


Veteran Member

Status: Offline
Posts: 45
Date:
Permalink  
 

Definitely looking forward to some improved linking!
It's worth pointing out though that if you put filter=$value1 $value2 in the workspace link, then that Workspace will be filtered by both values - which can really help focus the workspaces further

__________________

Excelian - GitHub

Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.



Create your own FREE Forum
Report Abuse
Powered by ActiveBoard