Understanding Data Forensics and the Workspaces Library

This topic describes the two main ways to analyze data in Workspaces and when to use each. Both use widgets and live data from Riverbed Console, but they are designed for different workflows: Data Forensics for unscripted, step-by-step investigation, and the Workspaces Library for opening and customizing saved workspace dashboards.

Data Forensics

Data Forensics is an interface for unscripted, step-by-step investigation. You start from a main table and add panels of charts and tables below it. Selections in the table or in a panel filter the panels beneath it. You drill down by clicking and adding visualizations as you go.

Layout: A main table at the top (fed by group bys In Workspaces Data Forensics, a dimension (e.g. application, host, service, client IP) that you choose from the sidebar to load data into the main table. Data is aggregated or broken down by that dimension. The sidebar lists available group bys for the selected analysis workspace. from the sidebar) and one or more panels below. Each panel has a toolbar to add charts and tables (time series, correlation, drilldown, etc.).
Flow: You drag group bys from the sidebar into the main table, select rows to focus on, and use the panel toolbar to add visualizations that respond to that selection. Time range and the filter bar apply across the workspace.
When to use it: When you are tracing the root cause of an issue, exploring data without a fixed dashboard, or building an ad-hoc investigation. For a walkthrough, see Building New Workflows in Data Forensics.

Workspaces Library

The Workspaces Library is a collection of preconfigured and user-saved workspaces. Each workspace is a grid of widgets (Data Store, Runbook, Text, and others) that you open, run, and optionally customize. There is no main table. You work directly with the widget grid.

Layout: A list of workflows on the left and a canvas of widgets on the right. You select a workspace from the list to load it, or create a new one. Widgets are added via the Add Widgets picker and can interact (e.g. table selection filters a chart).
Flow: Open or create a workspace, add or configure widgets, set time range and filters as needed, and save the workspace for later. For steps, see Editing Workspaces and Configuring Interactions in Library and Using Insights in the Workspaces Insight Library.
When to use it: When you want a ready-made or custom dashboard for a recurring use case (e.g. tunnel usage, performance by application), or when you want to share a fixed set of widgets and interactions.

Choosing between them

Use Data Forensics when you are exploring data step-by-step and building the investigation as you go. Use the Workspaces Library when you want to run or build a defined dashboard with a set of widgets and interactions. For more guidance, see Choosing the Right Workspaces Module.