Dashboards & Graphs

RunReveal’s dashboard system enables you to create custom visualizations of your security data using SQL queries against your ClickHouse tables. Build dashboards that surface critical insights and track key metrics in real-time.

Dashboard Components

Your RunReveal dashboards consist of three hierarchical components:

1. Graphs — Individual visualizations powered by SQL queries.
2. Panels — Containers that hold and size your graphs.
3. Dashboard Layouts — The overall arrangement of panels.

Available Visualization Types

-- Example: Events over time (best practice time bounds)
SELECT
  toStartOfInterval(receivedAt, INTERVAL {interval:Int64} SECOND) AS time_bucket,
  count() AS event_count
FROM runreveal.logs
WHERE receivedAt BETWEEN {from:DateTime} AND {to:DateTime}
GROUP BY time_bucket
ORDER BY time_bucket

-- Example: Top event sources
SELECT
  sourceType,
  count() AS events
FROM runreveal.logs
WHERE receivedAt BETWEEN {from:DateTime} AND {to:DateTime}
GROUP BY sourceType
ORDER BY events DESC
LIMIT 10

-- Example: Event distribution
SELECT
  sourceType,
  count() AS count
FROM runreveal.logs
WHERE receivedAt BETWEEN {from:DateTime} AND {to:DateTime}
GROUP BY sourceType
ORDER BY count DESC

-- Example: Total events KPI
SELECT count() AS total_events 
FROM runreveal.logs
WHERE receivedAt BETWEEN {from:DateTime} AND {to:DateTime}

Creating Graphs

SELECT
  toStartOfInterval(receivedAt, INTERVAL {interval:Int64} SECOND) AS time_bucket,
  count() AS events,
  sourceType
FROM runreveal.logs
WHERE receivedAt BETWEEN {from:DateTime} AND {to:DateTime}
GROUP BY time_bucket, sourceType
ORDER BY time_bucket

Creating Dashboards

Stacking Options

Control how multi-series data is displayed:

Query Examples

Here are practical examples of common dashboard visualizations with complete SQL queries and configuration details.

SELECT
toStartOfInterval(timestamp, INTERVAL 15 MINUTE) as time_bucket,
sum(CASE WHEN series = 'pipeline_entered_bytes' THEN value ELSE 0 END) /
sum(CASE WHEN series = 'pipeline_entered' THEN value ELSE 0 END) as avg_bytes_per_event
FROM external_metrics
WHERE timestamp >= {from:DateTime}
AND timestamp <= {to:DateTime}
AND series IN ('pipeline_entered', 'pipeline_entered_bytes')
GROUP BY time_bucket
HAVING sum(CASE WHEN series = 'pipeline_entered' THEN value ELSE 0 END) > 0
ORDER BY time_bucket ASC;

SELECT
srcIP,
c,
t
FROM (
SELECT
srcIP,
count() as c,
toStartOfHour(receivedAt) as t,
row_number() OVER (
PARTITION BY toStartOfHour(receivedAt)
ORDER BY count() DESC
) as rn
FROM logs
WHERE receivedAt BETWEEN {from:DateTime} AND {to:DateTime}
GROUP BY t, srcIP
) ranked
WHERE rn <= 10
ORDER BY t, c DESC;

WITH "__subquery0" AS (
SELECT * FROM "logs"
WHERE "receivedAt" > minus(CURRENT_TIMESTAMP(), toIntervalDay(1))
),
"__subquery1" AS (
SELECT "sourceType" AS "sourceType",
 "eventName" AS "eventName",
 count() AS "c"
FROM "__subquery0"
GROUP BY "sourceType", "eventName"
),
"__subquery2" AS (
SELECT * FROM "__subquery1"
ORDER BY "c" DESC NULLS LAST
LIMIT 10
)
SELECT *,
'barchart' as "render_type",
'stacked' as "render_prop_kind"
FROM "__subquery2";

SELECT
toStartOfInterval(receivedAt, INTERVAL {interval:Int64} SECOND) as time_bucket,
eventName,
COUNT(*) as event_count
FROM gcp_logs
WHERE receivedAt > {from:DateTime}
AND receivedAt <= {to:DateTime}
GROUP BY time_bucket, eventName
ORDER BY time_bucket ASC, eventName;

Creating Graphs with AI Chat

RunReveal’s AI chat makes it easy to create custom graphs using plain English. Simply describe what you want to see and the AI will generate the SQL query and configuration for you.

Template

Use this template to create graphs with natural language:

Create a graph showing event volumes for [SOURCE_NAME] using datetime and interval best practices. 

Specifically, I want to see:
- Event volumes grouped by [FIELD_TO_GROUP_BY]
- Time range: [TIME_RANGE]
- Time interval: [INTERVAL]
- Visualization type: [GRAPH_TYPE]

[Optional: Additional filters]

Example

Here’s a real example you can try:

Create a graph for okta_logs showing event counts by eventType over the last 7 days using hourly intervals as a line chart.

The AI will generate the appropriate SQL query with proper time filtering, grouping, and visualization configuration automatically.

Best Practices

Query Optimization

1. Always use time filters — Leverage {from:DateTime} and {to:DateTime} with BETWEEN or >=/<= operators.
2. Limit result sets — Add LIMIT for top‑N queries.
3. Use efficient aggregations — Prefer ClickHouse‑optimized functions:
   • toStartOfInterval() for time bucketing
   • countIf() for conditional counting
   • sumIf() for conditional sums

Time Intervals

RunReveal automatically calculates appropriate intervals based on your time range:

-- Let RunReveal handle interval sizing
toStartOfInterval(receivedAt, INTERVAL {interval:Int64} SECOND)
 
-- Or use fixed intervals for consistency
toStartOfHour(receivedAt)   -- Hourly buckets
toStartOfDay(receivedAt)    -- Daily buckets
toStartOfWeek(receivedAt)   -- Weekly buckets

Live Features

Real-Time Updates

• Graphs refresh automatically based on your time picker settings.
• Live data updates without manual refresh.
• Consistent data across all panels in a dashboard.

Interactivity

• Hover tooltips — See detailed values on hover.
• Time range selection — Integrated with global time picker.
• Responsive design — Adapts to different screen sizes.