Choosing the Right Workspaces Module

This topic helps you choose between Data Forensics and the Workspaces Library based on your task. Each tool is designed for a different way of working.

Data Forensics

Data Forensics is a panel-based interface for unscripted investigation. You start from a main table (fed by group bys In Workspaces Data Forensics, a dimension (e.g. application, host, service, client IP) that you choose from the sidebar to load data into the main table. Data is aggregated or broken down by that dimension. The sidebar lists available group bys for the selected analysis workspace. from the sidebar), select rows to focus on, and add panels of charts and tables below. Selections in the table or in a panel filter all panels beneath it, so you drill down step by step. What you do in Data Forensics:

Drag or double-click a group by into the main table to load data.
Select rows in the table or in a panel to narrow the scope. Panels below update automatically.
Add visualizations (time series, correlation, drilldown tables) in panels via the panel toolbar.
Use the filter bar and time range to restrict data across the workspace.

When to use it: When you are tracing the root cause of an incident or need to drill down from high-level data into specific sources without a fixed dashboard layout.

For a walkthrough, see Building New Workflows in Workspaces. For the interface components, see Exploring the Data Forensics Interface.

Workspaces Library

The Workspaces Library is a collection of preconfigured and user-saved workspaces. Each workspace is a grid of widgets (Data Store, Runbook, Text, and others) that you open from a list. There is no main table; you work directly with the widget grid. Widgets can interact (e.g. a table selection filters a chart).

What you do in the Workspaces Library:

Select a workspace from the list to load it, or create a new one.
Add or configure widgets using the Add Widgets picker.
Set time range and filters as needed, then save the workspace for later.

When to use it: When you want a ready-made or custom dashboard for a recurring use case (e.g. latency spikes, application An entity type representing software applications deployed in the customer environment that are monitored for performance and anomalies. or server bottlenecks, anomalous An unexpected event or measurement that does not match the expected model. traffic patterns) or when you want to share a fixed set of widgets and interactions.

To customize or remove workspaces, see Create New Workspaces From Preconfigured Workspaces and Delete a Customized Workspace.