Kaspersky Unified Monitoring and Analysis Platform

To configure the data display period, do one of the following:

• If necessary, change the date and time in the Time period setting in one of the following ways:
  • If you want to specify an exact date, in the calendar on the left, select the start and end date of the period and click Apply.

    You can select a date up to and including the current date. The date and time format depends on your browser settings. If the Date from or Date to field has a value and you have not edited the time value manually, when you select a date in the calendar, the Date from field is automatically populated with 00:00:00.000, and the Date to field with 23:59:59.999. If you have manually deleted the value in the Date from or Date to field, when you select a date in the calendar, the field is automatically populated with the current time. After you select a value in one of the fields, the focus switches to the other field. If your Date to is earlier than your Date from, this earlier value is automatically inserted into the Date from field.

  • If you want to specify a relative period, select one of the available periods in the Relative period list on the right.

    The period is calculated relative to the current time.

  • If you want to specify a custom period, edit the value of the Date from and Date to fields.

    You can enter an exact date and time in the DD.MM.YYYY HH:mm:ss.SSS format for the Russian localization and YYYY-MM-DD HH:mm:ss.SSS for the English localization or a period relative to the current time as a formula. You can also combine these methods if necessary. If you do not specify milliseconds when entering the exact date, 000 is substituted automatically. If you have edited the time in the Date from or Date to fields, picking a date in the calendar does not change the time component.

    In the relative period formulas, you can use the now parameter for the current date and time and the interval parameterization language: + (only in the Date to field), -, / (rounding to the nearest), as well as time units: y (year), M (month), w (week), d (day), h (hour), m (minute), s (second). For example, you can specify the period now-5d to get data for the last five days, or now/w to get data from the beginning of the first day of the current week (00:00:00:000 UTC) to the current time (now).

    The Date from field is required, and its value cannot exceed the value of the Date from field, and also cannot be earlier than 1970-01-01 (if specifying an exact date or a relative period). The Date to cannot be earlier than the Date from. If you do not specify a value in the Date from field, now is specified automatically.

  KUMA stores time values in UTC, but in the user interface time is converted to the time zone of your browser. This is relevant to the relative periods: Today, Yesterday, This week, and This month. For example, if the time zone in your browser is UTC+3, and you select Today as the data display period, data will be displayed for the period from 03:00:00.000 until now, not from 00:00:00.000 until now.

  If you want to take your time zone into account when selecting a relative data display period, such as Today, Yesterday, This week, or This month, you need to manually add a time offset in the Date from and Date to fields (if a value other than now is specified) by adding or subtracting the correct number of hours. For example, if your browser's time zone is UTC+3 and you want to display data for Yesterday, you need to change Date from to now-1d/d-3h and Date to to now/d-3h. If you want to display data for the Today period, you only need to change the value in the Date from field to now/d-3h.

  If you need results up to 23:59:59:999 UTC of yesterday, you can use an SQL query with a filter by Timestamp or specify an exact date and time.

  The bounds of the period are inclusive: for example, for the Today time range, events are displayed from the beginning (00:00:00:000 UTC) of the current day to the current time (now) inclusive, and for the Yesterday period, events are displayed from the beginning (00:00:00:000 UTC) of the previous day to 00:00:00:000 UTC of the current day. You can view the date and time of the last data update and the exact period for which the data is displayed by hovering over the period icon in the widget.

  If the Show data for previous period setting is enabled for the widget, and the widget is displaying data for a relative period, the tooltip also displays the previous period. The previous period is calculated relative to the current period as start and end values of the current period minus the duration of the current period. For example, if data is updated daily and displayed for a month, but only the first 10 days of the month have passed, the previous period is taken to be the last 10 days of the previous month.

• If you want the widget to display data for the period selected for the layout, click the Reset button. Changing the displayed period on the layout also changes the period displayed in the widget.

To create a query in Builder:

1. Specify the values of the following parameters:
   1. SELECT—event fields that should be returned. The number of available fields depends on the selected graph type.
      • In the drop-down list on the left, select the event fields for which you want to display data in the widget.
      • The middle field displays what the selected field is used for in the widget: metric or value.

        If you selected the Table graph type, in the middle fields, you must specify column names using ANSII-ASCII characters.

      • In the drop-down list on the right, you can select an operation to be performed on the data:
        • count—event count. This operation is available only for the ID event field. Used by default for line charts, pie charts, bar charts, and counters. This is the only option for date histogram.
        • max is the maximum value of the event field from the event selection.
        • min is the minimum value of the event field from the event selection.
        • avg is the average value of the event field from the event selection.
        • sum is the sum of event field values ​​from the event selection.
   2. SOURCE is the type of the data source. Only the events value is available for selection.
   3. WHERE—conditions for filtering events.
      • In the drop-down list on the left, select the event field that you want to use for filtering.
      • Select the necessary operator from the middle drop-down list. The available operators depend on the type of value of the selected event field.
      • In the drop-down list on the right, enter the value of the condition. Depending on the selected type of field, you may have to manually enter the value, select it from the drop-down list, or select it on the calendar.

      You can add search conditions by clicking Add condition or remove search conditions by clicking .

      You can also add groups of conditions by clicking Add group. By default, groups of conditions are added with the AND operator, but you can change the it if necessary. Available values: AND, OR, NOT. Group conditions are deleted using the Delete group button.

   4. GROUP BY—event fields or aliases to be used for grouping the returned data. This parameter is not available for Counter graph type.
   5. ORDER BY—columns used as the basis for sorting the returned data. This parameter is not available for the Date Histogram and Counter graph types.
      • In the drop-down list to the left, select the value that will be used for sorting.
      • Select the sort order from the drop-down list on the right: ASC for ascending, DESC for descending.
      • For Table type graphs, you can add sorting conditions by clicking Add column.
   6. LIMIT is the maximum number of data points for the widget. This parameter is not available for the Date Histogram and Counter graph types.
2. Click Apply.

Parameters of search conditions for displaying the average number of bytes per host in the widget