Analyse und Reporting
für Web | Netzwerk | Sicherheit
Zugriffs- und Datenanalyse von Server-Logs (Proxy, Mailserver, Firewall, Webserver) und Überwachung der Sicherheit & Performance, Schwachstellenanalyse.
Sawmill Analytics 8 | Loganalyse
Sawmill-Tutorial
Date Range Filtering
When viewing or generating reports, it is often useful to see reports for a particular day, month, or year; or a particular range of days. This can be done with the Date Picker, the Report Date option of the Scheduler, or Date Filter Expressions.
The Date Picker
Sawmill has a dedicated window in the Reports section of the web interface, just for date filtering:
The Date Picker
In addition to filtering on a particular day, week, month, quarter, or year (using the "Date or Start Date" tab), or on a specific range of days (using the "Date or Start Date" and "End Date" tabs together to select the starting and ending day of the range), it is also possible to filter on a relative range of days. For instance, you can filter on the "recent 5 days" to select the most recent 5 days relative to the date the report is generated, including the current day; or you can filter on the "last 2 weeks" to select the most recent 5 days relative to the date the report is generated, excluding the current day.
When a date or range is selected in the Date Picker, the generated report will be created from only those events which occurred during a specified period.
Date Filtering In The Scheduler: The Report Date Option
The Date Picker is available only for ad hoc web-based reporting, but when sending reports from the Scheduler, you can use the Report Date option to some types of common date filters:
The Report Date Option (Scheduler)
The default includes the entire range of dates. The second and third options specify a specific number of units (e.g., 5 days, or 2 weeks), counting backward from the date of the report, or from the end of the log data. The last option lets you enter a date filter expression, described below.
When a Report Date option is specified, the generated report will be created from only those event which occurred during the specified period.
Advanced Topic: Date Filter Expressions
The Date Picker is available when using the Reports section of the profile to generate ad hoc reports through the web interface, and the Report Date option is available when generating reports from the Scheduler. In other situations, date filtering is done by typing a date filter expression. These include:
- Reports generated from the Scheduler using the Custom Date Filter
option of the Report Date option
- Custom reports or report elements with permanent Date Filters
- Reports generated from the command line
- Permanent per-profile date filters
| 01/Jan/2008 |
All data from January 1, 2008 |
| Jan/2008 | All data from January, 2008 |
| Q2/2008 |
All data from the second quarter of 2008 (April
1, 2008 through June 30, 2008) |
| 2008 |
All data from 2008 |
Any two simple date expressions can be combined with a hypen to form a range, which selects data from the beginning of the first expression, to the end of the second expression:
| 01/Jan/2008-15/Jan/2008 |
All data from January 1, 2008
through January 15, 2008 |
| Jan/2008-May/2008 | All data from January, 2008 through May, 2008 |
| Q2/2008-Q3/2008 |
All data from the second quarter of 2008,
through the third quarter of 2008 (April 1, 2008 through September 30,
2008) |
| 2008-2009 |
All data from 2008 through 2009 (two full years
of data) |
Date range expressions can also be relative to the time of report generation:
| last 30 days |
All log data from the last 30 days.
Last excludes the current calendar day. |
| recent 30 days |
All log data from the most recent
30 days of the log data, relative to the moment of report generation.
Recent includes the current calendar day. |
| recent 2 quarters |
All log data from the most recent 2 full
quarters, including the quarter when the report is generated (the
current quarter). |
| yesterday |
All log data from yesterday |
| today |
All log data from today |
| 2 weeks ago |
All log data from the week two weeks before
report generation |
Other options (useful only in ranges), include:
| end |
The last second of log data |
| start |
The first second of log data |
| start of X |
The first second of the range X, which
can be any non-range date expression (e.g., "start of yesterday") |
| end of X |
The last second of the range X, which
can be any non-range date expression (e.g., "end of Q2/2008") |
| unit N units
before X |
The time unit (e.g., month) N units
before the range X (e.g., "month 4 months before 2008") |
Advanced results can be achieved by combining the items above into ranges, keeping in mind that a range goes from the first second of the first item, until the last second of the last item, e.g.:
| 2 weeks ago-yesterday | The last two weeks, except today |
| start of 2008-1 week ago | January 1, 2008 through the day one
week ago |
| 4 weeks ago-3 weeks ago | All data collected between 3 and 4 weeks ago |
| Q1/2006-end of 2008 | January 1, 2006 through December 31, 2008 |
| week 2 weeks before end-week 0 weeks before
end |
The last two weeks of data in the database
(relative to the end of the data in the database). |
Advanced Topic: Date Filter Expressions Plug-ins
The date filter syntax is quite flexible, but if you need a date filter which is not supported, it is possible to add support for it by writing a date filter expression plug-in. The details of date filter expression plug-in authoring are beyond the scope of this document, but in brief, it is a CFG file in the date_filters folder of LogAnalysisInfo, which describes (1) what the expression looks like, (2) what parameters it has, and (3) how to compute the beginning and end of the range it represents. All expressions above are implemented in this way, so the examples in that folder can serve as a good starting point for writing your own. This could be used, for instance, to implement date filters based on fiscal quarters ("FQ1/2008-FQ2/2008"), holidays ("Labor Day, 2009"), or anything else ("third tuesday of Jan, 2009-end of 2009"; "start of 2008-my birthday, 2008").
[Article revision v1.0]
Professionelle Dienstleistungen
Sollten Sie die Anpassung von Sawmill Analytics nicht selbst vornehmen wollen, können wir Ihnen dies als Dienstleisung anbieten. Unsere Experten setzen sich gerne mit Ihnen in Verbindung, um die Reports oder sonstige Aspekte von Sawmill Analytics an Ihre Gegebenheiten und Wünsche anzupassen. KontaktZur Tutorial-Übersicht