Gravwell is an enterprise data fusion platform that enables security teams to investigate, collaborate, and analyze data from any source, on demand, all with unlimited data collection and retention. Ingest everything. Investigate anything.
We are pleased to announce the immediate availability of Gravwell 4.2.4. This release fixes several minor issues from the previous release, improves performance, and brings both Data Explorer and Query Studio (more on that in a moment) out of beta.
We introduced Query Studio with the 4.2.0 release in order to streamline the query writing process. Users of the original query bar tend to keep multiple windows open, switching between variations of a query, history, notes, etc. Query Studio unifies query writing, output, history, and more, and provides a tabbed interface that is saved in your browser storage for returning to later. It’s been a hit, so we thought we’d take a deep dive into all Query Studio provides.
The Query Studio UI
This is not an article about writing queries, but instead just a tour of all the features in Query Studio. That said, let’s take a look at how things were done before.
The original (and still the default way to write a query… for now) query bar is meant to be simple -- you have a text box, a search button, and the option to see your history. That’s it. While that works well in some situations, by simply getting out of your way, it’s not exactly inviting you to explore your data, nor is it very welcoming to the user that works with Gravwell all day.
Query Studio unifies search, results, notes, and history into a single interface, and provides the ability to highlight data and open multiple searches. Let’s take a look at the Query Studio interface:
There’s certainly a lot more going on here than the default search page. Let’s visit each section.
The search bar you already know, although now it’s bigger. Gravwell always supported multi-line queries, but now it’s easier than ever to format large queries into something more readable.
The results section is similar to what you would see in an executed query -- charts, tables, etc. The difference here is that it’s always visible along with the large search box area, making tweaks and iterations to queries simple.
Query Studio brings enhanced annotations to the table renderer. We’ll talk more about this later.
The sidebar contains your query library, search history, notes, and editor settings. Clicking on a query in your library or search history will put it into the search box. This enables you to quickly pull up searches without having to fumble through other menus.
Once a query has been executed, you can add notes to the query, which get saved to the query output as part of the saved search. This is great for scratch space and other annotations to queries that may not be so obvious at first glance.
The settings section allows you to set the theme and font size for the search box.
Query Studio provides tabs that save your query in your browser local storage. This means you can not only open multiple searches in one place, but you can safely close your browser and come back to your work after that half-day lunch at the bowling alley sensible sandwich you brought from home.
New Ways to Work with Tables
The table renderer is distinct from searches in the default search mode, in that it now supports enhanced column ordering and collapsing, data organization, highlighting (think favorites), and other ways to summarize your view. It’s a big enough change that it’s worth walking through each feature.
Table Formatting Features
Tables can often be too large to make sense of, have too many columns to render in a readable way on screen, and in general just be messy. Query Studio adds column formatting options as a dropdown box to each column, enabling you to add row numbers, hide columns, auto-size columns, export as CSV, and more.
You can also change the column order by dragging columns to their desired location.
Query Studio also brings “highlights” to the table renderer. By right clicking on a row, you can select “highlight row”, which adds it to the highlighted row menu, located at the bottom of the table renderer. The highlighted row menu shows you just the rows you’ve highlighted, filtering out all other rows. Perfect for drilling down for presentations!
We’re excited to bring you Gravwell 4.2.4. Gravwell's new Query Studio tool can help you understand your data faster than ever, with all of your query authoring tools and results in one place. Stay tuned for more improvements to Query Studio in the future.