HAAGE&PARTNER Computer GmbH  HAAGE&PARTNER

Sawmill Analytics

Analyse und Reporting
für Web | Netzwerk | Sicherheit

Zugriffs- und Datenanalyse von Server-Logs (Proxy, Mailserver, Firewall, Webserver) und Überwachung der Sicherheit & Performance, Schwachstellenanalyse.

Sawmill Analytics 8 | Loganalyse

Sawmill-Tutorial

Date Range Filtering


When viewing or generating reports, it is often useful to see reports for a particular day, month, or year; or a particular range of days. This can be done with the Date Picker, the Report Date option of the Scheduler, or Date Filter Expressions.


The Date Picker

Sawmill has a dedicated window in the Reports section of the web interface, just for date filtering:

DatePicker

The Date Picker

In addition to filtering on a particular day, week, month, quarter, or year (using the "Date or Start Date" tab), or on a specific range of days (using the "Date or Start Date" and "End Date" tabs together to select the starting and ending day of the range), it is also possible to filter on a relative range of days. For instance, you can filter on the "recent 5 days" to select the most recent 5 days relative to the date the report is generated, including the current day; or you can filter on the "last 2 weeks" to select the most recent 5 days relative to the date the report is generated, excluding the current day.

When a date or range is selected in the Date Picker, the generated report will be created from only those events which occurred during a specified period.


Date Filtering In The Scheduler: The Report Date Option

The Date Picker is available only for ad hoc web-based reporting, but when sending reports from the Scheduler, you can use the Report Date option to some types of common date filters:

SchedulerDateRange

The Report Date Option (Scheduler)


The default includes the entire range of dates. The second and third options specify a specific number of units (e.g., 5 days, or 2 weeks), counting backward from the date of the report, or from the end of the log data. The last option lets you enter a date filter expression, described below.

When a Report Date option is specified, the generated report will be created from only those event which occurred during the specified period.


Advanced Topic: Date Filter Expressions

The Date Picker is available when using the Reports section of the profile to generate ad hoc reports through the web interface, and the Report Date option is available when generating reports from the Scheduler. In other situations, date filtering is done by typing a date filter expression. These include:
Date Filter Expressions are strings of characters. The simplest options select single date units, e.g.:

01/Jan/2008
All data from January 1, 2008
Jan/2008 All data from January, 2008
Q2/2008
All data from the second quarter of 2008 (April 1, 2008 through June 30, 2008)
2008
All data from 2008

Any two simple date expressions can be combined with a hypen to form a range, which selects data from the beginning of the first expression, to the end of the second expression:

01/Jan/2008-15/Jan/2008
All data from January 1, 2008 through January 15, 2008
Jan/2008-May/2008 All data from January, 2008 through May, 2008
Q2/2008-Q3/2008
All data from the second quarter of 2008, through the third quarter of 2008 (April 1, 2008 through September 30, 2008)
2008-2009
All data from 2008 through 2009 (two full years of data)

Date range expressions can also be relative to the time of report generation:

last 30 days
All log data from the last 30 days. Last excludes the current calendar day.
recent 30 days
All log data from the most recent 30 days of the log data, relative to the moment of report generation. Recent includes the current calendar day.
recent 2 quarters
All log data from the most recent 2 full quarters, including the quarter when the report is generated (the current quarter).
yesterday
All log data from yesterday
today
All log data from today
2 weeks ago
All log data from the week two weeks before report generation

Other options (useful only in ranges), include:

end
The last second of log data
start
The first second of log data
start of X
The first second of the range X, which can be any non-range date expression (e.g., "start of yesterday")
end of X
The last second of the range X, which can be any non-range date expression (e.g., "end of Q2/2008")
unit N units before X
The time unit (e.g., month) N units before the range X (e.g., "month 4 months before 2008")

Advanced results can be achieved by combining the items above into ranges, keeping in mind that a range goes from the first second of the first item, until the last second of the last item, e.g.:

2 weeks ago-yesterday The last two weeks, except today
start of 2008-1 week ago January 1, 2008 through the day one week ago
4 weeks ago-3 weeks ago All data collected between 3 and 4 weeks ago
Q1/2006-end of 2008 January 1, 2006 through December 31, 2008
week 2 weeks before end-week 0 weeks before end
The last two weeks of data in the database (relative to the end of the data in the database).


Advanced Topic: Date Filter Expressions Plug-ins

The date filter syntax is quite flexible, but if you need a date filter which is not supported, it is possible to add support for it by writing a date filter expression plug-in. The details of date filter expression plug-in authoring are beyond the scope of this document, but in brief, it is a CFG file in the date_filters folder of LogAnalysisInfo, which describes (1) what the expression looks like, (2) what parameters it has, and (3) how to compute the beginning and end of the range it represents. All expressions above are implemented in this way, so the examples in that folder can serve as a good starting point for writing your own. This could be used, for instance, to implement date filters based on fiscal quarters ("FQ1/2008-FQ2/2008"), holidays ("Labor Day, 2009"), or anything else ("third tuesday of Jan, 2009-end of 2009"; "start of 2008-my birthday, 2008").

[Article revision v1.0]


Professionelle Dienstleistungen

Sollten Sie die Anpassung von Sawmill Analytics nicht selbst vornehmen wollen, können wir Ihnen dies als Dienstleisung anbieten. Unsere Experten setzen sich gerne mit Ihnen in Verbindung, um die Reports oder sonstige Aspekte von Sawmill Analytics an Ihre Gegebenheiten und Wünsche anzupassen. Kontakt

Zur Tutorial-Übersicht

Weitere Informationen

      Live-Demonstrationen »    
© 1995-2011 HAAGE & PARTNER Computer GmbH · Impressum · Datenschutz · www.haage-partner.de