Analyze data

Gain insights from your data visually, and run aggregations across all or a subset of events in a dataset.

The Datasets tab allows you to gain insights from your data visually.

Rather than inspect individual events, you can run aggregations across all or a subset of events in a dataset and visualize the output. Queries can be crafted to get any level of detail from results, and are easily saved for future use as well as being easy to share with team members.

This section introduces the Datasets tab and its components that unlock powerful insights from your data.

Select a dataset

As all events in Axiom reside in a dataset, first choose a dataset to analyze. When no dataset is chosen, you are presented with a list of your datasets and quick-access panels for recent Starred Queries and Query History (see Dataset Overview for more detail):

Datasets overview

Select a dataset from the list of datasets:

Datasets lists

Dataset overview

After selecting a dataset, you see an overview of the dataset, its fields, starred queries, query history, and the query builder:

Dataset overview

Fields List

The fields list gives an overview of all fields from all events that are in this dataset.

Field Type

• Supported types are:
  • string
  • number
  • boolean
  • array
• Field names are flattened with dot-notation so an event like {"foo": { "bar": "baz" }} as a field called foo.bar

Field name

Field names match the JSON specification. Field names containing periods (.) are folded.

If you get a 400 when you use the field name _time with the Elastic Search endpoint or when you override the timestamp field, use the query parameter ?timestamp-field to set a field as the time field.

Quick charts

Quick charts allow fast charting of fields depending on their field type. For example, number fields have quick charts for easily visualizing percentiles, averages, and histograms.

Fields list

Virtual fields

Virtual fields are powerful expressions that run on every event during a query to create new fields. The virtual fields are calculated from the events in the query using an APL expression. They’re similar to tools like derived-columns in other products but super-charged with an expressive interpreter and with the flexibility to add/edit/remove them at any time.

Virtual fields slide-out

Click Virtual fields on the toolbar to manage of a dataset’s virtual fields.

Virtual fields tool button

Starred queries

Starred queries are queries saved for future use. They’re great for keeping a list of useful queries for a dataset. All starred queries are shared with your team.

Click Starred queries on the toolbar to manage starred queries.

Starred tool button

Query history

Every query you and your team members run is given a unique ID and saved inside Axiom. Use the query history to share results with other members or find a past query that you want to star for future use.

Click Query History on the toolbar:

Query history tool button

You see historical queries in reverse-chronological order. You can choose between your own queries or those of your team:

Query history slide-out

Build a query

Use the query builder to create or edit queries for the selected dataset:

Query builder

This component is a visual query builder that eases the process of building visualizations and segments of your data.

This guide walks you through the individual sections of the query builder.

Time range

Every query has a start and end time and the time range component allows quick selection of common time ranges as well as the ability to input specific start and end timestamps:

Time range

• Use the Quick Range items to quickly select popular ranges
• Use the Custom Start/End Date inputs to select specific times
• Use the Resolution items to choose between various time bucket resolutions

Against

When a time series visualization is selected, such as count, the Against menu is enabled and it’s possible to select a historical time to compare the results of your time range too.

For example, to compare the last hour’s average response time to the same time yesterday, select 1 hr in the time range menu, and then select -1D from the Against menu:

Time range against menu

The results look like this:

Time range against chart

The dotted line represents results from the base date, and the totals table includes the comparative totals.

When you add field to the group by clause, the time range against values are attached to each events.

Time range against chart

Visualizations

Axiom provides powerful visualizations that display the output of running aggregate functions across your dataset. The Visualization menu allows you to add these visualizations and, where required, input their arguments:

Visualizations menu

You can select a visualization to add it to the query. If a visualization requires an argument (such as the field and/or other parameters), the menu allows you to select eligible fields and input those arguments. Press Enter to complete the addition:

Visualizations demo

Click Visualization in the query builder to edit it at any time.

Learn about supported visualizations

Filters

Use the filter menu to attach filter clauses to your search.

Axiom supports AND/OR operators at the top-level as well as one level deep. This means you can create filters that would read as status == 200 AND (method == get OR method == head) AND (user-agent contains Mozilla or user-agent contains Webkit).

Filters are divided up by the field type they operate on, but some may apply to more than one field type.

Filters demo

List of filters

String Fields

• ==
• !=
• exists
• not-exists
• starts-with
• not-starts-with
• ends-with
• not-ends-with
• contains
• not-contains
• regexp
• not-regexp

Number Fields

• ==
• !=
• exists
• not-exists
• >
• >=
• <
• <=

Boolean Fields

• ==
• !=
• exists
• not-exists

Array Fields

• contains
• not-contains
• exists
• not-exists

Special fields

Axiom creates the following two fields automatically for a new dataset:

• _time is the timestamp of the event. If the data you ingest doesn’t have a _time field, Axiom assigns the time of the data ingest to the events.
• _sysTime is the time when you ingested the data.

In most cases, you can use _time and _sysTime interchangeably. The difference between them can be useful if you experience clock skews on your event-producing systems.

Group by (segmentation)

When visualizing data, it can be useful to segment data into specific groups to more clearly understand how the data behaves.

The Group By component enables you to add one or more fields to group events by:

Group by

Other options

Order

By default, Axiom automatically chooses the best ordering for results. However, you can manually set the desired order through this menu.

Limit

By default, Axiom chooses a reasonable limit for the query that has been passed in. However, you can control that limit manually through this component.

Results view

Axiom displays the results of the query in the Explore tab. For more information, see Explore.