An administrator needs to save a search to use it in the dashboards. To do so, which search feature does the administrator need to select in the "Include in my Dashboard" checkbox?

Question

Options

• AFilter events of the last 7 days
• BFilter events of the last month
• CFilter events of the last 5 minutes
• DGroup by some property

• A
  13% (4)
• B
  7% (2)
• C
  3% (1)
• D
  77% (23)

Explanation

Group by some property is the correct choice because dashboards display aggregated, structured data - not raw event streams. When you select "Group by some property," the search produces a summarized result set (counts, totals, etc. per group) that can be rendered as a chart, table, or widget on a dashboard. Without aggregation, there's no meaningful visual unit to pin to a panel.

Options A, B, and C (time-based filters) are wrong because filtering by a time range simply narrows which events are returned - it does not transform the results into an aggregated format that a dashboard widget can display. Time filters are a prerequisite for many searches, but they alone cannot satisfy the "Include in my Dashboard" requirement.

Memory tip: Think of it this way - a dashboard panel needs something to count or summarize, and "Group by" is what creates that summary. If there's no grouping, there's nothing to chart. No group = no graph.

No community discussion yet for this question.