Datasets

A dataset is the unit you actually work with. It pins a template to a period and a presentation, gives that combination a name, and keeps it. Everything else in reporting is built on datasets: a report is a stack of them, and a schedule delivers them.

One template backs any number of datasets. The template TACACS+ authentication can sit behind “TACACS+ authentication — last 24 hours”, “TACACS+ failures by device, last 30 days” and “TACACS+ command activity, top 20” at the same time, each saved separately.

Reporting → Datasets → New dataset opens the catalogue. Templates are grouped by area — AAA, NAC, Configuration Tracker, System, Alerts — and each card says what question the template answers and whether it is a Preset or a Table.

Choosing a template. The description tells you what the template answers; the badge tells you which kind it is.

Pick one, and you land in the builder with a live preview on the right.

The builder: configuration on the left, a rendered preview on the right. The preview marks itself out of date when you change something, and refreshes on demand.

Every dataset has a name and, if its template takes one, a period.

The period is always relative — last 24 hours, last 7 days, last 30 days, last 60 days, or a custom number of days. A dataset never stores absolute dates. That is deliberate: a dataset called “last 7 days” still means the last seven days in six months’ time, whether you open it by hand or a schedule mails it to you. (A one-off export can override the window with fixed dates — see Exports — but that does not change what the dataset holds.)

Some templates are point-in-time and have no period at all: an inventory of your devices, or the current certificate posture, is a snapshot of how things are now. The catalogue marks which is which.

A preset owns its own layout, so there is exactly one more choice: the view. A template that offers several gives you meaningfully different cuts of the same data — a full dashboard versus a bare totals row, an overview versus a rejects breakdown, a daily trend versus an hourly one.

A table hands you the presentation:

• Chart — table, bar, line, area, pie, donut or stat.
• Aggregation — group by a column, choose a function (count, sum, average, minimum, maximum) and a measure, optionally split into series, and cap the number of categories so a high-cardinality column doesn’t produce a thousand slices. For time-based grouping you also pick a granularity: hourly, daily, weekly or monthly.
• Columns — which are shown; some are hidden by default.
• Sort — column and direction, chosen from the columns the template allows.
• Row limit — up to the template’s maximum.

The chart picker only offers mappings the template supports, because each column is declared as either a dimension (something to group or plot along an axis) or a measure (something to count or sum). That is why you cannot accidentally build a chart that averages a hostname.

The preview is rendered by the server, not drawn in your browser — the same rendering path that produces the PDF. What you see in the panel is what lands in the file.

Quick view on the dataset list opens the same rendered result without entering the builder, which is the fastest way to read a dataset you are not editing.

Quick view: the rendered document plus the configuration it was rendered with — the view and the period, so a screenshot of it is self-explanatory.

Each row shows its template, kind, presentation and when it was last modified — plus which reports use it.

Row actions are Quick view, Export, Configure, Duplicate and Delete.

Duplicate is the natural way to make a variant: copy “last 7 days” into “last 30 days” rather than rebuilding it.

Delete is guarded. If a report uses the dataset, deletion is refused and the reports holding it are named, so you are never left with a report page pointing at something that no longer exists. Remove the page from the report first, or delete the report.

If a template is removed in a future release, datasets built on it do not break — they show a template removed marker instead, and the rest of your reporting keeps working.

A monthly access review. Take the Authentication failures preset, set the period to 30 days, name it for the review, and add it to a report you schedule on the first of the month.

A device that has gone quiet. TACACS+ device usage and RADIUS device usage include devices with zero requests in the window, which is the half that matters — a device that stopped talking to you produces no log rows at all, so it is only visible from the inventory side.

A top-N you keep coming back to. Build it once as a table dataset with an aggregation and a row limit, name it precisely, and stop rebuilding the filter.

• Template catalogue — what each template answers
• Reports — composing datasets into a document
• Exports — getting a dataset out as a file