How to create customize dashleta?

[RSAAdmin]

We have created many graphical dashboard in envision like top 10 denied connection to critical system, failed login to critical system using custom query and many more dashboard.
Now want to create it in SA.

I have tried to modify default dashlet (investigation top value) in SA but it is giving me only one meta value and count in tabular format. We required it graphical way.

Also I cannot run custom query in it.

Like: select metavalue name from table name where condition

Kindly assist me

[huanzhou1]

there is a dashlet called Investigation Top Values, you can input your query.

[RSAAdmin]

it will not give me graphical out put like bar,pi chart

could u pls give me sample query.

[huanzhou1]

you can use "Reporting Realtime Chart" which actual refer to the rules which you create the chart.

[Anonymous]

What you are going to want is a realtime chart that is summarizing your data.  I will give you an example that we are using currently.  We have an app rule that is catching any url that has admin in it on our hosted sites.  The rule in the reporting engine is now looking for that app rule while the country exists and is not the united states. 

Select ip.src

Where alert = 'cocc_admin_web_page' && country.src != 'united states' && country.src exists

aggregate and I don't put a restriction on max results.

When making the chart have it point to that rule and limit it to ten.  And have it update at what ever interval you want. 

Add a new dashlet for a realtime chart.

Point that chart to the newly created one.  Have it summarize the data for however many hours you want.    I find that a pie chart tends to render better. 

[RSAAdmin]

thanks, i tried it. but complete one day data is populating in chart.

i require only last one hour data and refresh it every 5 minuet.

I set refresh interval 5 minuet.

[huanzhou1]

you can choose past hours = 1