How to add Len dashboards to canvas

[TheHunter1]

Hello,

I have created a dashboards using Len to display the new users created in my different AD, and the name of the machine where they have been created, I added some filters and the final result look like that:

Then I saved it and I want to add it to my Canvas, but when I add it there I get a result like that :

Could you please explain to me why I don't have the same result ? and how I can solve it !

(In both Len and Canvas I am using the same time range)

Thanks for your help

[wylie (Wylie Conlon)]

Hi, I think this is a result of two things:

1. There is a bug that I fixed in Lens 7.10: instead of showing 0 results, you get the tiny number that you are seeing.
2. You mentioned that you got this result in dashboard after applying filters. Have you applied the same filters to Canvas?

You should make sure that the time range and filters are set up identically in Dashboard vs Canvas, it's the most likely cause of the difference. If the filters are meant to be part of the visualization, you could save the filters inside the Lens visualization.

[TheHunter1]

Thanks for your answer @wylie,

The filters are inside the Lens visualisation, I added them in the right Tab of len as it's shown in the picture bellow

and the time range is the same that I am using in Len and canvas ( I added a Time filter element in my canvas, and then applied the time filter)

NB: Knowing that I am testing Elasticsearch and Kibana from code source, so it's version 8.0.0

[wylie (Wylie Conlon)]

You said that your time filter is being applied in Canvas, but are you sure? Please show the pipeline expression logic that you've written for both your time filter and your Lens visualization.

[TheHunter1]

So for Len visualisation I added one filter event.code: "4720" and then sliced by event.code and then by agent.hostname and finally by winlog.event_data.TargetUserName ( I don't know if I explained it well, so I will give you screen shots of my configuration in the right tab of Len )

And the final result is like that: (As we can see, I am applying a filter for the last 1 year)

And then I saved my dashboard, and in the canvas I added this dashboard and added Time filter element to be able to add time filters

[wylie (Wylie Conlon)]

Okay, so there is at least one issue happening here: each embedded Lens visualization has its own time filter which is a) not automatically connected to other filters in Canvas and b) if you do manually connect it by modifying the expression, it acts as an AND filter. So in your screenshot you have set the Lens time range to 15 minutes.

If you are interested in using the time filter component to filter the Lens visualization, it's possible but requires manual set. You will need to set the Lens timerange to a very large value, and then modify the expression for the Lens visualization to be filters | savedLens ...

[TheHunter1]

So if I understand well, you mean I can to add the filter of time before I save my Len and add to the Canvas, so I don't need to add a filter in my canvas ? (sorry, if I didn't understand it well as it's my first time using Len and Canvas I used just to use dashboards )

If it's the case, could you tell me please from where I can add the time filter ?

I tried to add a SQL query after adding it to the canvas but I am getting this

no way to add sql queries

[wylie (Wylie Conlon)]

No, you can't save the time filter as part of the Lens visualization. There is a button for "Last 15 minutes" next to the title in Canvas, that button will let you choose the time range.

[TheHunter1]

Ohhhhh Thank you very much I didn't see that button it was so small
now it's working perfectly