Advanced Analysis Charts

After you click Process in the Advanced Analysis form, the results are displayed in the chart panel below the form. The chart panel provides interactive visualizations of the analysis results and supports multiple chart types.

Switching chart types

Use the visualization toggle in the chart panel header to switch between chart types. The following chart types are available:

• Pie chart — The default view. Displays the top results as pie slices proportional to the selected metric.
• Sankey diagram — Displays traffic flows across multiple columns (aggregations) to show relationships between values in different fields. This option is only available when two or more aggregations are configured in the analysis Aggregate multiselect.
• In time chart — Displays results as a line chart over time. This option is only available when time-series data is present in the analysis results (for Sort by values from Amounts category).
• Bar chart — Displays the top 10 results as horizontal bars sorted by the selected metric.

Common features across all chart types:

• Hover highlighting synchronized between chart and results table
• Interactive legend — click a legend item to show or hide that data series in the chart

Selecting a metric

Use the metric drop-down in the chart panel header to change the metric used for the visualization. The available metrics are Input bytes, Flows, Input packets and a custom value set in Sort by select if it differs from these.

Expanding and collapsing the panel

Click the expand or collapse button in the chart panel header to resize the chart panel for a larger or smaller view.

Pie chart

The pie chart displays all items returned by the query. The top 10 items are shown with distinct colors. Items ranked 11 and beyond are shown in a more subdued color scheme. Use the Show Other toggle to display the non-top-10 items in a separate secondary pie chart alongside the main one.

Hovering over a slice highlights the corresponding row in the results table and vice versa.

Click a legend item to show or hide the corresponding slice.

Sankey diagram

The Sankey diagram visualizes traffic flows across multiple columns, helping you understand relationships between fields such as source IP, destination IP, and port.

Use the column selector in the panel to choose which columns to include in the diagram and in what order.

Right-click a node or flow path to open a context menu with the option to copy the value to the filter field.

The Sankey diagram includes a column legend below the chart. Click a column entry in the legend to show or hide that column in the diagram. At least two columns must remain visible at all times.

The results table below the chart displays a color indicator in each column header corresponding to the column's color in the Sankey diagram.

In time chart

The In time chart displays results as a line chart over time, showing how traffic evolved within the selected time window.

The following controls are available in the In time chart:

• Volumetric selector — Switch between Traffic, Flows, and Packets to change the unit displayed on the left y-axis.
• Linear / Logarithmic — Toggle between a linear and logarithmic y-axis scale.
• Stacked / Line — Display data series stacked on top of each other or as independent lines.
• NPM metrics — Toggle NPM metrics (Jitter, Round Trip Time, and Server Response Time) on or off as a secondary y-axis.
• Retransmission — Toggle retransmission data as an alternative secondary y-axis.

The chart legend below the visualization is interactive. Click a series entry to show or hide that series. When NPM metrics or retransmission series are displayed on the secondary y-axis, their legend entries can be toggled independently from the main traffic series.

Bar chart

The bar chart displays all items returned by the query as horizontal bars sorted by the selected metric in descending order. The top 10 items are shown with distinct colors. Items ranked 11 and beyond are shown in a more subdued color scheme.

Hovering over a bar highlights the corresponding row in the results table and vice versa.

Click a legend item to show or hide the corresponding bar.