2015-09-22 08:22 AM
How to create custom dashlet in SA to monitor "TOP 10 Activity based on user/Ip ".
I tried to create a dashboard "By Using Investigation Top Values " but the result is in tabular form like ("Meta " (count of selected meta") and even if the result limit is set to "10 " It shows all data during that interval.
Kindly let me know how to customize the dashlet to show "Top 10 Activities"
2015-09-24 10:13 AM
Also note that you can only have one key in the SELECT clause, and then you should be able to make a chart out of it and finally a dashlet.
Once you have created the chart, test it. You should be able to produce data. Once you can produce the data you are looking for, make a dashlet out of it. NOTE: Once you create the dashlet, it may take 5-10 mins before that dashlet actually shows any information. Until it does, it may show "NO DATA AVAILABLE". That doesnt mean your dashlet doesnt work, it just takes a while for it to populate.
2015-09-23 03:49 PM
Create the rule in the reporting engine section, the use it to create a chart.
In the dashlets, create a dashlet with Reporting Realtime Chart and select the chart you just created.
Just check that the chart if showing the information you really want.
RSA once told me that the charts should be simple queries. No very advanced
2015-09-24 10:13 AM
Also note that you can only have one key in the SELECT clause, and then you should be able to make a chart out of it and finally a dashlet.
Once you have created the chart, test it. You should be able to produce data. Once you can produce the data you are looking for, make a dashlet out of it. NOTE: Once you create the dashlet, it may take 5-10 mins before that dashlet actually shows any information. Until it does, it may show "NO DATA AVAILABLE". That doesnt mean your dashlet doesnt work, it just takes a while for it to populate.
2015-09-29 05:36 AM
Thanks for the reply Linuts and Adam.
2015-09-29 05:36 AM
It worked