Viewing Event Data

Once data has been ingested into Workstation, there are generally two main methods to locate events:

1. Use the Events Stream widget to find ingested events.
2. If Event Notifications have been configured, utilize the Notifications or Notifications Explorer widgets to view the event notifications.

Regardless of which widget the event comes from, drag the event or notification into another widget to view its data. The Object Details Viewer is the primary widget to use to view the latest information on an event.

Finding Ingested Events

The Event Stream widget includes a text search to match events based on user-defined queries. Some useful searches include:

• Searching by subject name.
• Searching for events by event title.
• Searching for keywords contained within an event's data.

To search by text string:

1. From an open view, at the top of an event stream widget, click the magnifying glass icon (🔍).
2. Type a keyword into the search field.
3. Press the ENTER key, or wait a moment for Workstation to return results. Any data fields that matched your search term are displayed as a column on the Events Stream widget.

Note

Workstation datasets are usually extremely large. Broad keyword matching can take a moment to compile a full list of events.

More detailed search facets applied to the events stream can help hone results.

Sorting Events Stream Widget Data

Headers of the event stream widget are clickable, allowing users to sort by a specific value.

To sort Events Stream widget data:

1. From an open view, at the top of a populated Events Stream widget, locate the header to sort by.
2. Click the header to determine sort order:
   • Click once to sort by ascending order.
   • Click twice to sort by decending order.
   • Click three times to return to default sorting state.

Reveal Data Fields for Event Stream Widgets

The Events Stream widget hides certain columns to present a more compact view. Hidden or visible columns help emphasize prominent information. The Events Stream widget table displays the following by default:

Title	Risk Score	Occurred
The title of the event	An associated risk score as processed by Authoring/HCEP and if applicable	The timestamp of when the event occurred, if applicable.

To show or remove columns:

1. From an open view, at the top of an Events Stream widget, click Show Columns. A dropdown list shows all available data fields associated with the event stream.
2. Tick the box on or off to select or deselect data fields. Selection of a data field affects results in real-time.
3. Click inside the event stream widget to close the checkbox list of data fields.

To reset columns to their default state:

1. From an open view, at the top of an Events Stream widget, click Show Columns. A dropdown list shows all available data fields associated with the event stream.
2. At the top of the dropdown list, click Reset columns.
3. The events stream widget reloads to its default state.
4. Click inside the event stream widget to close the checkbox list of data fields.

Narrowing event notification data helps find important events for further analytical drilldown.

Note

When columns are reset, any columns returned as a result of a text search or data field filter applied in search facets will remain.