Skip to main content

Creating Visualizations with Copilot

TL;DR

Copilot can help you create powerful visualizations by simply describing what you want to see, without needing to know the specific charting syntax.

Another powerful capability of Cribl Copilot is helping you create visualizations and dashboards. Let's explore how Copilot can turn your natural language descriptions into compelling visual insights.

Scenario: Visualizing Network Traffic​

Imagine you want to create a visualization that shows your network traffic patterns by source and destination IP addresses. Instead of manually configuring a chart in Search, you can hover over cribl-search-sample .

Creat a Visualization
  1. Open Search and find cribl_search_sample
  2. Hover over and press Visualize
  3. There will be tiles that come up to the right called Visualize Dataset. Go ahead and select the ones the reflect your data the best.
  4. With each tile we can add or create a new dashboard by clicking ... and selecting Add to Dashboard. Lets hold off on that for now.

Copilot will analyze your data and suggest a visualization configuration. The response will typically include:

  1. Search query: The underlying query needed to get the data (after adding to dashboard)
  2. Visualization type: The recommended chart type (bar chart, pie chart, etc.)
  3. Add to dashboard: How to apply this to your dashboard or create a new one
Implement the Visualization
  1. Review Copilot's suggested visualization configuration
  2. We are going to go ahead and customize the panels. Select Write your own and populate the prompt with:
Action and Status Overview
  1. Click the ... and select Add to Dashboard implement the visualization.
  2. Add as many panels as you would like. lets at-least add the Accept

Refining Your Visualization​

One of the most powerful aspects of Copilot is the ability to refine your requests through conversation. If the initial visualization isn't exactly what you wanted, you can ask for adjustments.

Refine the Visualization
  1. After seeing the initial visualization, ask Copilot something like:
Action and Status Overview with datasource="vpcflowlogs"
  1. Copilot will suggest a refined visualization that only is for the datasource vpcflowlogs

This conversational approach allows you to iteratively improve your visualizations without needing to understand the technical details of how they're configured.

Optional

Try asking Copilot to create different types of visualizations:

  • "Can you show me the rejects and top 10 ips from the datasource="vpcflowlogs""

Next, we'll explore how Copilot can help you with search queries.