This the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Visualisation Types

This section introduces you to the types of visualisations available in Dashboards

1 - Timechart

A Timechart is a graph produced by applying statistical aggregation to a label over an interval. The X-axis of a timechart will always be time.

Timecharts allow you to see the change in metric value over time. The amount of data visualized on a graph is dependent on the time selection selected within the Dashboard. You can aggregate metrics from multiple sources into a single line, or graph a line per combination of segment labels.

Time aggregation: For example, the average value of sysdig_host_cpu_used_percent metric is computed for each entity over 1 hour at 1-minute intervals.

Group Rollup: For each host_hostName the values from time aggregation are averaged over the scope and the top 10 segments are shown on the chart.

For information on configuring a chart, see Create a New Panel.

Types of Timecharts


Stacked Area

Stacked Bars

Timechart look and feel can be configured under Display settings when configuring a panel.

When to use

TypeUse case
LineWhen quickly identifying outlier segments is important.
When plotting a single metric over time.
Stacked AreaWhen an aggregate view of segments is needed.
Stacked BarsWhen metrics are sometimes reporting zero.

2 - Number

Number panels allow you to view a single value for a given entity, along with optionally comparing the current value to historical values. Use the Number panel when the number is the most important aspect of the metric you’re trying to display, such as unique visitors to a website.

Do not use this panel to see a trend, rather use it when you need to see the average of a value over the given time range. This is also useful for counting entities, such as the number of nodes in a cluster.

For information on configuring a panel, see Create a New Panel.

Major Features

  • The default preset for the Number visualization is 1 hour.

  • The global default values for the threshold are overridable. The new value can be reset back to the global default.

  • A comparison between two threshold values determines color-coding directions.

  • The Compare To functionality can be toggled between enabled and disabled.

  • When the Compare To value is set, the preview is updated accordingly showing the comparison value and an arrow denoting the metric has increased or decreased.

  • The unit displayed for Thresholds is determined by the query.

3 - Table

The Table panel displays your queries in tabular form. Use Table panels for quantitative analysis where you want to see actual values instead of visual representations. Similar to a spreadsheet, you can look at a combination of metric values and segments. This is useful when you don’t necessarily care about the change of a metric over time, or want to run reports to download as CSV/JSON for offline analysis.

The metric values are determined by the data source and the query.

Build an Aggregate View of Your Workloads Per Cluster and Namespace

This example shows how to build a Form table panel to view a concatenated list of workloads per cluster and namespace.

When configuring the panel options, choose:

  • Segmentation: kube_cluster_name and kube_namespace_name
  • Metrics/Labels: kube_workload_name
  • Time aggregation: Concat

You can then export the results as CSV for further exploration.

View Resource Utilization of Your Kubernetes Workload Using a PromQL Table Panel

This example shows how to build a PromQL table panel to view resource utilization of your Kubernetes workload.

For demonstration, CPU and memory utilization is evaluated against the given quota in each workload, cluster, and namespace. The query displays top 10 segments that consume highest number of CPU cores and highest amount of memory.

  • CPU Used Percent

    topk(10,avg(avg_over_time(sysdig_container_cpu_used_percent{$__scope}[$__interval])) by (kube_cluster_name, kube_namespace_name, kube_workload_name))
  • CPU Quota

    topk(10,avg(avg_over_time(sysdig_container_cpu_cores_quota_limit{$__scope}[$__interval])) by (kube_cluster_name, kube_namespace_name, kube_workload_name))
  • Memory Used Percent

    topk(10,avg(avg_over_time(sysdig_container_memory_used_percent{$__scope}[$__interval])) by (kube_cluster_name, kube_namespace_name, kube_workload_name))
  • Memory Quota

    topk(10,avg(avg_over_time(sysdig_container_memory_limit_bytes{$__scope}[$__interval])) by (kube_cluster_name, kube_namespace_name, kube_workload_name))

Select an appropriate unit of value for each query to return meaningful result. For example, use number for CPU quota, data for memory quota, and percent resource utilization metrics.

To scope down your selection, use the scope variable in combination with Team scope.

In this example, the panel scope is limited to two clusters (netsec-load-data, test-k8s-data), one namespace (kube-system), and one workload (coredns).

The PromQL panel supports the configuration of dynamic links. You can generate an external or internal URL using the label values returned by the PromQL query.

To add a link, open the Links tab and enter:

  • the URL template. In the URL you can reference a label value with {{label_name}}.
  • the link title.

** Note: ** if you have an URL that needs the { and } character, they must be escaped with \.

Explore Kubernetes Objects from a PromQL Table

This example shows how to configure the table links to explore a Kubernetes object on Metrics Explorer:

  1. Use the URL that gives the Metrics Explorer default All Workloads:
  1. Apply the labels to the URL:
  • Show cluster in Metrics Explorer:


  • Show namespace in Metrics Explorer:


  • Show workload in Metrics Explorer:


Show Host Logs on Mezmo

This example shows how to configure the table links to show the host logs on Mezmo:

  1. Use the default URL of the company named Mezmo, where w52qwe12vv is the account id:

  2. Apply the host label:{{host_hostname}}

Known Limitations

  • The PromQL panel currently doesn’t support exporting results
  • The PromQL panel column order doesn’t honor the query segmentation order

Beta Features

  • The PromQL panel show a maximum of 250 rows. This limit can be changed with a beta flag in the settings page:

4 - Text

The example below uses a text panel as a reminder list of the testing steps for a procedure.

Text Panel Markdown


# H1
## H2
### H3
#### H4
##### H5
###### H6



*italics* or _italics_
**bold** or __bold__
**combined _emphasis_**


1. First ordered list item
2. Second item
  * Unordered sub-list.
    Sub-paragraph within the list item.
1. Third item
  8. First ordered sub-list item.
103. Fourth item

General guidelines:

  • The list item number does not matter. As shown in the example below, the formatting defines the lists.

  • List items can contain properly indented paragraphs, using white space.

  • Unordered list can use: *, -, or +.


This is the first sentence.

This line is separated from the one above by two newlines, so it will be a *separate paragraph*.

This line is also a separate paragraph.
This line is only separated by a single newline, so it's a separate line in the *same paragraph*.

Trailing spaces can be used for line-breaks without creating a new paragraph. This behavior is contrary to the typical GFM line break behavior, where trailing spaces are not required.

5 - Toplist

A Toplist chart displays the specified number of entities, such as containers, with the most or least of any metric value. This is useful for “ranking” metric values in order, for example, considering hosts that have the highest amount of pods running or the highest consumers of CPU or memory in your infrastructure.

Major Features

  • Toplist supports executing multiple queries.

  • Segmentation is supported for all queries.

  • Text displayed on the bars in the chart is based on queries and segmentation.

    • If there is a single query without segmentation, the query name is displayed.

    • If there is a single query and multiple segmentations are selected, segmentation texts separated by > sign are displayed.

    • If there are multiple queries, the query name is displayed on the bar.


You can use multiple objects to simultaneously segment a single metric. For example, cpu.used.percent segmented by,, and

In this example, deployments are sequentially listed in the order of resource consumption. Use Display to toggle between descending (Top) and ascending order (Bottom).

6 - Histogram

Sysdig Monitor handles three types of Histograms:

  • Histogram panel type on the Dashboard: Histogram panels allow you to visualize the distribution of metric values for large data collection. You should select a segmentation, and optionally, the number of buckets.

    Use Histogram for any metric, Sysdig native or custom, counter or gauge, segmented by a dimension/label. The histogram panel helps understand value across different segments. For example, CPU usage percent by containers across your hosts gives you the aggregated value across the selected time.

  • Legacy Prometheus histogram collection: This implementation of legacy Prometheus Histograms is deprecated in SaaS 3.2.6 release.

    To create a Histogram, use the Prometheus integration to collect histogram metrics and use the PromQL panel with the histogram_quantile function.

  • Prometheus histograms (collected as raw metrics): The legacy Prometheus histogram collection is replaced by the new Prometheus histogram. You can natively collect histogram metrics, and for visualization, use timechart:

    For example, run the following query to build a timechart:

    sum(histogram_metrics_bucket{kubernetes_cluster_name="prod"}) by (le)