SQL Analytics
SQL Analytics allows you to carry out advanced manipulation of data using a SQL query before you visualize it.
The analytics editor provides full featured SQL support and is powered by DuckDB—an in-process database management system designed for efficient analytical query processing.
For example, you could create an SQL query to:
- Calculate the average time difference between when a ticket is created and resolved using SQL, then visualize the Mean Time To Resolution (MTTR).
- Query AWS CloudWatch data to find the 95th percentile response time of a microservice, and display it as a Service Level Indicator (SLI).
- Combine entry points from different sources, such as Azure Cost data and Azure Monitor data, to analyze the potential cost savings of turning off unused virtual machines.
The beta version of SQL Analytics previously used AlaSQL. While you can still copy the tiles created using the beta version, copying an AlaSQL query may not always be possible due to compatibility reasons.
Switching to the analytics editor
In the tile editor, click SQL Analytics at the top of the screen. This changes your view from the simple tile editor into the more advanced SQL Analytics Editor.
It's best to decide whether you want to stick with the SQL Analytics Editor for a particular tile, or with the simple editor, rather than switching between the two.
As with the simple editor, you can still add Monitoring or KPIs.
If you exit out of the SQL Analytics mode, reverting to using the default tile editor for a tile, then you lose your SQL queries and datasets, as only the first dataset is saved.
Datasets
A dataset is the data stream and selected objects combined. If you had already selected a data stream and objects in the simple tile editor, this will be shown as dataset1 and you will be taken straight to the SQL tab.
The new name must be alphanumeric, with no spaces or punctuation. At the point of renaming, if the SQL query is unmodified, the name of the dataset is automatically updated in the SQL query.
Dataset buttons
Use the following buttons to create new, copy existing and delete data sets.
Creating SQL queries
This uses standard Structured Query Language (SQL) and is and is powered by DuckDB.
By default, the Query tab in the SQL section of the SQL Analytics Editor contains a query that returns everything from the first dataset. Edit this query to return and manipulate your data as needed.
Select * FROM tickets
If you perform a Count aggregation on the Shaping tab for a dataset and therefore have a column named "count", you must wrap the column name in `` to reference it in SQL: `count`
.
Query editor buttons
Use the following buttons to interact with the Enter your query window.
IntelliSense
The SQL query editor comes packed with IntelliSense, designed to streamline query creation. Each keystroke triggers the assistant and and provides:
- Context-aware auto-complete: The editor suggests relevant SQL syntax, table names, and column fields based on your current input, reducing the chance of errors and speeding up query writing.
- Real-time error detection: Common mistakes such as syntax errors or missing keywords are flagged as you type, helping you correct issues early.
Querying multiple datasets
A major advantage of SQL analytics mode is that you can query data from more than one dataset at a time, and even combine datasets by using a JOIN, etc.
For example, the following SQL query compares the number of new and solved tickets per day by combining data from two different datasets.
WITH created AS (
SELECT `count` AS NewTickets,
created_at_byDay AS TDay
FROM dataset1
ORDER BY TDay),
solved AS (
SELECT `count` AS SolvedTickets,
solved_at_byDay AS TDay
FROM dataset2
ORDER BY TDay)
SELECT TDay,
COALESCE(NewTickets, 0) AS Created,
COALESCE(SolvedTickets,0) AS Solved
FROM (
SELECT * from created
OUTER JOIN solved on solved.TDay = created.TDay
)
ORDER BY TDay
This builds a daily comparison of ticket creation and resolution, which you can can then visualize as separate trend lines on a line graph:
Columns
The Columns section of the SQL tab functions exactly the same same as the Columns tab in the default tile editor, and is used to to format the columns of your datasets.
SquaredUp automatically defines the metadata retrieved from data streams so the data is assigned the correct data type, however in some circumstances you may want to override this.
For example, when retrieving data using the Web API plugin, scripting, or custom query data streams (such as Splunk Enterprise plugin), the assigned data type may not be quite correct or as you expect.
Formatting columns
Use the following options to format your columns.
Comparison columns
Comparison columns are used to compare two values, for example you may want to compare the number of tickets raised this month to the number of tickets raised last month. You can choose to show the value as an absolute change (for example, 12 more tickets) or as a percentage change (for example, a 28% increase).
When a column has a Type of Number, the Add comparison
button displays at the end of the row, which you can click to open the Add comparison window.- Column A:
Select the first column to compare against. Automatically populated with the column of which you clicked Add comparison. - Column B:
Select the second column to compare against. - Output:
Select how to display the comparison value. This value is displayed in the Preview field. Choose from:- Absolute: Show the numerical value of Column A - Column B.
- Percentage: Show the ratio of Column B to Column A as a percent.
- Click Add to create the comparison.
Additional options
Some data types have advanced settings that can be configured in the options section, which is displayed whenever you change the data Type or by clicking expand
next to the column Name.Visualization
Visualization settings are configured on the Visualization tab of the right-hand panel in the tile editor.
Which visualizations are offered to you depends on the data available, for example Line Graph will only be offered if there is time series data in your dataset.
For detailed information on configuring visualizations, see Visualization Settings.