>
&html<
My Widget
>
Set tInfo(1) = $LB("Sales","UP","12")
Set tInfo(2) = $LB("Costs","DOWN","-8")
Set tInfo(3) = $LB("Profits","UP","18")
&html<
>
Set n = $O(tInfo(""))
While (n'="") {
Set tName = $LG(tInfo(n),1)
Set tDir = $LG(tInfo(n),2)
Set tPct = $LG(tInfo(n),3)
Set clr = $S(tPct<0:"red",1:"black")
Set bg = $S(n#2:"#FFEEEE",1:"white")
Set tPct = tPct _ "%"
&html<
| #(tName)# |
#(tDir)# |
#(tPct)# |
>
Set n = $O(tInfo(n))
}
&html<
> &html<
>
}
}
When used as a widget, the widget has the following contents:
This example displays static data, but your portlet could display real-time data.
For a more complex example that also defines settings, see the sample class BI.Model.PortletDemo.ClockPortlet.
Other Development Work for Business
Intelligence
Depending on the users’ needs and the business requirements, you may have to do some or all of the additional development work described here, as part of your Business Intelligence implementation.
### 15.1 Adding Paper Sizes
When users print a dashboard widget to a PDF file, the system pro vides a default set of paper sizes, and the user can choose
among them. To extend this set of sizes, add nodes as needed to the ^DeepSee.PaperSizes global, as follows:
Node
Value
^DeepSee.PaperSizes(n) where n is an integer
$LISTBUILD(sizename,dimensions) where sizename is the name
of the size and dimensions specifies the dimensions. dimensions
must have one of the following forms:
widthxheight in
widthxheight mm
There must be exactly one space between height and the unit name.
For example:
Set ^DeepSee.PaperSizes(1) = $LB("My Sticker","100x100 mm")
The new size is immediately available.
### 15.2 Auditing User Activity
You can execute custom code, such as writing to an audit log, every time a user executes a query or accesses a dashboard.
To add custom code to execute when users execute a query, perform the following one-time setup steps:
Other Development Work for Business Intelligence
- Write a class method, routine, or subroutine that contains the custom code. The first subsection provides details on the
requirements and options; the second subsection provides an example.
- Set ^DeepSee.AuditQueryCode equal to a string containing a valid ObjectScript statement that executes that method, routine, or subroutine.
For example, do the following in the Terminal:
set ^DeepSee.AuditQueryCode="do ^MyBIAuditCode"
Every time a query is executed in this namespace, the system executes the code specified in ^DeepSee.AuditQueryCode, thus invoking your routine or class method.
Similarly, to add custom code to execute when users access a dashboard:
- Write a class method, routine, or subroutine that contains the custom code.
- Set ^DeepSee.AuditCode equal to a string containing a valid ObjectScript statement that executes that method, routine, or subroutine.
Every time a dashboard is accessed in this namespace, the system executes the code specified in
^DeepSee.AuditCode.
#### 15.2.1 Audit Code Requirements and Options
When you define audit code for either scenario, mak e sure that the code does not write any output to the current device. Also make sure that it does not kill any % variables required by InterSystems IRIS® data platform.
Your code can use the following variables:
- $USERNAME — name of the current user.
- $ROLES — roles of the current user.
- %dsQueryText — text of the current query.
- %dsCubeName — logical name of the cube used in the current query.
- %dsResultSet — current instance of %DeepSee.ResultSet, which you can use to access other information, if needed. For details on working with %DeepSee.ResultSet, see Executing Business Intelligence Queries Programmatically.
- %dsDashboard — name of the dashboard that is being accessed, if any.
Typically, audit code writes output to a file or to a global.
Note that %dsQueryText, %dsCubeName, and %dsResultSet are only available to audit routines using ^DeepSee.AuditQueryCode, while %dsDashboard is only available to routines using ^DeepSee.AuditCode.
#### 15.2.2 Example
The following shows a simple example audit routine. It has one subroutine for use with ^DeepSee.AuditQueryCode
and another subroutine for use with ^DeepSee.AuditCode:
Defining Server Initialization Code
; this is the routine DeepSeeAudit
quit
dashboard
set auditentry="At "_$ZDT($H,3)_", " _$USERNAME_" accessed dashboard: "_%dsDashboard
set ^MyBIAuditLog($INCREMENT(^MyBIAuditLog))=auditentry
quit
query
set auditentry="At "_$ZDT($H,3)_", " _$USERNAME_" ran query: "_%dsQueryText
set ^MyBIAuditLog($INCREMENT(^MyBIAuditLog))=auditentry
quit
To use this routine, we would enter the following two lines in the Terminal:
SAMPLES>set ^DeepSee.AuditQueryCode="do query^DeepSeeAudit"
SAMPLES>set ^DeepSee.AuditCode="do dashboard^DeepSeeAudit"
To see the audit log, we can use ZWRITE. The following shows example results (with line breaks added for readability):
SAMPLES>zw ^MyBIAuditLog
^MyBIAuditLog=2 ^MyBIAuditLog(1)="At 2014-06-20 16:26:38, SamSmith accessed dashboard: User Defined Listing.dashboard"
^MyBIAuditLog(2)="At 2014-06-20 16:26:38, SamSmith ran query: SELECT NON EMPTY {[MEASURES].[AMOUNT
SOLD],
[MEASURES].[UNITS SOLD]} ON 0,NON EMPTY [DATEOFSALE].[ACTUAL].[YEARSOLD].MEMBERS ON 1 FROM [HOLEFOODS]"
### 15.3 Defining Server Initialization Code
To define serv er initialization code:
- Place a valid ObjectScript statement in the ^DeepSee.InitCode global.
For example, do the following in the Terminal:
set ^DeepSee.InitCode="do ^myroutine"
- Make sure that the code does not write any output to the current device.
- Also make sure that it does not kill any % variables required by InterSystems IRIS.
This code is called by the %RunServerInitCode() method of %DeepSee.Utils. This method is called whenever an Inter- Systems IRIS Business Intelligence session is created.
During a Business Intelligence implementation project, you should define access to functionality and Business Intelligence items. InterSystems IRIS® Business Intelligence has a formal mechanism that is based on the underlying InterSystems security framework.
This page assumes that you are familiar with InterSystems security as described in Authorization Guide. In particular, it assumes that you understand the relationships between resources, roles, and users.
Note:
If you install InterSystems IRIS® data platform with the Minimal Security option (and if you do not tighten security after that), the user UnknownUser belongs to the %All role and has access to all parts of Business Intelligence. In this case, ignore this page.
Important:
Also note that you use Business Intelligence from within a web application. By default, a web application can access a subset of InterSystems classes, which does not include the %DeepSee classes. To use Business Intelligence in your web application, you must explicitly enable access to Analytics. For details, see Setting Up the Web Applications.
### 16.1 Overview of Security
The following table summarizes how elements in Business Intelligence are secured:
Element
How Secured
Business Intelligence User Portal
%DeepSee_Portal and %DeepSee_PortalEdit resources
Analyzer
Architect
%DeepSee_Portal, %DeepSee_Analyzer, and
%DeepSee_AnalyzerEdit resources
%DeepSee_Portal, %DeepSee_Architect and
%DeepSee_ArchitectEdit resources
Folder Manager and Cube Manager
%DeepSee_Portal and %DeepSee_Admin resources
MDX Query Tool and Settings pages
Term List Manager and Quality Measure Manager pages
Listing Group Manager
Cubes, subject areas, listings, listing fields, listing groups, KPIs, folders, and folder items (such as dashboards and pivot tables)
Quality measures
%DeepSee_Portal, %DeepSee_Admin, and %Development resources
%DeepSee_Portal and %DeepSee_PortalEdit resources
%DeepSee_ListingGroup, %DeepSee_ListingGroupEdit, and
%DeepSee_ListingGroupSQL resources
Custom resources (optional)
Accessible only to users of any cubes to which the quality
measures are published; no additional security
Term lists
No security options
For details, see Security Requirements for Common Business Intelligence Tasks, later in this page.
### 16.2 Basic Requirements
For a user to use Business Intelligence, the following must be true, in addition to the other requirements listed in the rest
of this page:
- The user must have access to the database or databases in which Business Intelligence is used.
By default, when you create a database, InterSystems IRIS does the following:
– Creates a resource with a name based on the database name (%DB_database_name).
–
Establishes that this resource controls access to the new database.
– Creates a role with the same name as the resource. This role has read and write privileges on the resource.
You can specify whether the read and write privileges are public. These privileges are not public by default.
For example, suppose that you create a database called MyApp for use with Business Intelligence, and you let InterSystems IRIS create the resource and role as described here, and suppose that the read and write privileges are not public. In this case, a Business Intelligence user must belong to the %DB_MyApp role, which has read and write privileges on the
%DB_MyApp resource.
- If the ^DeepSee globals are mapped from another database, the user must also have access to the database that contains these globals.
Security Requirements for Common Business Intelligence Tasks
### 16.3 Security Requirements for Common Business Intelligence Tasks
The following table lists the security requirements for common tasks, in addition to the items in the previous section.
Task
Viewing the User Portal (apart from the Analyzer or the mini Analyzer) with no ability to create dashboards
Viewing the User Portal (apart from the Analyzer or the mini Analyzer) with the ability to create new dashboards
Viewing a dashboard (including exporting to Excel and printing to
PDF)
USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_PortalEdit resource
- USE permission for the %DeepSee_Portal resource
- USE permission for the resource (if any) associated with the dash-
board; see Adding Security for Model Elements
- USE permission for the resources (if any) associated with the pivot tables used in the dashboard
- USE permission for the resources (if any) associated with the folders that contain the dashboard and the pivot tables
- USE permission for the resources (if any) associated with the cubes or subject areas** used in the pivot tables
- USE permission for the resources (if any) associated with the KPIs used in the dashboard
- SQL SELECT privilege for all tables used by the queries of the KPIs Note that the system displays all widgets to which the user has permission. That is, the dashboard is displayed even though the user cannot see all of it.
Read-only access to the Analyzer or Mini Analyzer
Full access to the Analyzer or Mini
Analyzer
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_Analyzer resource
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_AnalyzerEdit resource
Task
Viewing a listing
Modifying an existing pivot table in the Analyzer
Creating a new dashboard
Modifying an existing dashboard
Read-only access to the Architect
Creating a new cube or subject area in the Architect
Modifying an existing cube or subject area in the Architect
- USE permission for the %DeepSee_Portal resource
- USE permission for the resource (if any) associated with the listing
- SQL SELECT privilege for all source tables used by the listing and
SELECT privilege for the generated CubeClass.Listing table for that
cube. If a custom listing uses the $$$RESTRICT token, SELECT
privilege on the CubeClass.Listing table are required.
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_AnalyzerEdit resource
- USE and WRITE permissions for the resource (if any) associated with the given pivot table
- USE permission for the resources (if any) associated with the folders that contain the pivot table
- USE permission for the resources (if any) associated with the cube** or subject area used in the pivot table
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_PortalEdit resource
- USE permission for the resource (if any) associated with the folder that contains the dashboard
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_PortalEdit resource
- USE and WRITE permissions for the resource (if any) associated with the given dashboard
- USE permission for the resource (if any) associated with the folder that contains the dashboard
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_Architect resource
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_ArchitectEdit resource
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_ArchitectEdit resource
- USE and WRITE permissions for the resource (if any) associated
with the given cube or subject area; see Adding Security for Model
Elements
Adding Security for Model Elements
Task
- Folder Manager page
- MDX Query Tool page
- Settings pages
- Term List Manager page
- Quality Measures page
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_Admin resource or USE permission for the %Development resource
- USE permission for the %DeepSee_Portal resource
- USE permission for the %DeepSee_PortalEdit resource Listing Group Manager (read only access) Listing Group Manager (edit access, except for custom SQL query options)
USE permission for the %DeepSee_ListingGroup resource
USE permission for the %DeepSee_ListingGroupEdit resource
Listing Group Manager (edit access, including custom SQL query options)
- USE permission for the %DeepSee_ListingGroupEdit resource
- USE permission for the %DeepSee_ListingGroupSQL resource *Also see the previous section. Note that in your resource definitions, some of the permissions might be public. F or example, in a minimal security installation, by default, the USE permission is public for all the Business Intelligence resources.
**If a cube contains relationships to other cubes, those cubes are secured separately. A user must have USE permission for all of them in order to use the relationships. Similarly, a compound cube consists of multiple cubes, which are secured separately.
### 16.4 Adding Security for Model Elements
To add security for a cube, subject area, KPI, pivot table, dashboard, listing, or listing field:
1. Create a resource in the Management Portal. Use the Resources page (select System Administration > Security >
Resources).
2. Create a role in the Management Portal. Use the Roles page (select System Administration > Security > Roles). This
role should have USE and WRITE permissions on the resource you just created.
Or you could create one role with USE and WRITE permissions and another role with only USE permission.
3. Associate the resource with the Business Intelligence item as follows:
- For a dashboard or pivot table, when you save the item, type the name of the applicable resource into the Access Resource field.
- See also Specifying the Resource for a Dashboard or Pivot Table.
- To save a dashboard or pivot table, you must also have the USE and WRITE privileges for the appropriate Business Intelligence user interface component, as described in the previous heading.
For a cube, subject area, or listing field, use the Architect to specify the resource that secures that item.
For a listing defined in a cube definition, use the Architect to specify the resource that secures that item.
- For a listing group or for a listing defined in a listing group, use the Listing Group Manager to specify the resource that secures that item.
- For a KPI, edit the class definition in your IDE. Use the name of the applicable resource as the v alue of the RESOURCE class parameter.
4. Assign users to roles as needed.
### 16.5 Specifying the Resource for a Dashboard or Pivot Table
To specify the resource for a dashboard or pivot table, specify the Access Resource field when you sa ve the item. You can
do this in any of the following cases:
- The item has no owner (specified as the Owner field).
- You are the owner of the item.
- You have USE permission on the %DeepSee_Admin resource.
### 16.6 Specifying the Resource for a Folder
To specify the resource for a folder:
1. Click the InterSystems Launcher and then click Management Portal.
Depending on your security, you may be prompted to log in with an InterSystems IRIS username and password.
2. Switch to the appropriate namespace as follows:
a. Click the name of the current namespace to open the list of available namespaces.
b. From the list, click the appropriate namespace.
3. Click Analytics > Admin > Folder Manager.
4. Click the check box next to a folder.
5.
In the left area, click the Details tab.
6. Type the name of the resource.
See Also
7. Click Save Folder.
### 16.7 See Also
- Setting Up the Web Applications
- Authorization Guide
A
This page describes how to use the cube version feature for Business Intelligence, which enables you to modify a cube definition, b uild it, and provide it to users, with only a short disruption of running queries. Cube versions are an optional feature that may be helpful in your Business Intelligence implementation.
This feature requires twice the amount of disk space, per cube. Also, this feature requires editing the cube class in an IDE.
Note:
The cube version feature is not supported for a cube that defines a formally shared dimension. It is also not supported
for a cube that defines a one-way relationship; it can be used with cubes that define
two-way relationships.
A.1 Introduction to the Cube Version Feature
The cube version feature enables you to modify a cube definition, b uild it, and provide it to users, with only a short disruption
of running queries. The feature works as follows:
- A given cube definition can ha ve versions.
- The system generates a version-specific f act table and dimension tables for each cube version.
- At any given time, only one cube version is active. The user interfaces and all generated queries use this version.
- To make the newest cube version available, it must be activated. At this point, the system momentarily blocks any queries from being run and then switches to the newest version.
The following figure sho ws the overall process:
The cube logical name is redirected automatically to the active cube. The Analyzer and other user interfaces use only the cube logical name and thus see only the active cube. Similarly, if you use methods in %DeepSee.Utils and you specify the cube logical name without a version number, the system runs the method against the active cube.
When you update the cube version number in an IDE and recompile the cube class, that creates a pending cube, which you can then build. When you are ready, you use a utility method to activate the cube, which causes the pending cube to become active and causes the previously active cube to become deprecated.
By default, the activation process automatically deletes the deprecated cube. The cube version feature is not intended to support switching back and forth between versions.
The best practice is to use source control. The cube version feature is not a replacement for source control, but can be helpful in conjunction with it.
A.1.1 Keeping the Cube Current
If a cube uses the cube version feature, you cannot build the active version of the cube. That is, the %BuildCube() method
does not affect the active version; instead, an error is returned. Attempting to build the cube using a Business Intelligence
utility such as the Architect or the Cube Manager yields the same result. These actions are blocked because they would disrupt running queries for a long time, and the goal of this feature is to prevent that disruption.
You can, however, synchronize the cube.
A.1.2 Model Changes Can Break Queries
The cube version feature does not check to ensure that queries that function correctly on the active cube will function correctly on the pending cube. For example, if the pending cube no longer includes a model element that is defined in the acti ve
cubelogicalname,witho...deprecatedcubependingcube...deprecatedcubeuserinterfacesutilitymethodsredirectedautomaticallydeprecatedcubescanberemovedautomaticallyactivecubeCreatenewcubeversionsoverti...
cube, any queries that use that element will not work when you activate the pending cube. It is the customer’s responsibility to identify model changes that could cause disruption and to handle such changes appropriately.
Modifying a Cube to Support Versions
A.2 Modifying a Cube to Support Versions
To modify a cube so that it supports the cube version feature (and to create and activate the initial version):
Important:
Read this note if you are making a transition to cube versions and you have existing cubes that do not use this feature and you do not want any queries to be disrupted.
When you make the transition to cube versions, the process is different for the fir st cube version. Specifically , the first cube v ersion should be runtime-compatible with the cube currently in use (the unversioned cube definition). This means that the first cube v ersion should not remove or redefine an y measures or levels,
compared to the non-versioned cube definition. It can add elements; that has no ef fect on existing queries.
1. Add the following parameter to the cube class:
Parameter USECUBEVERSIONS=1;
To make this change and the next, it is necessary to use an IDE.
2. Add the following attribute to the