# Build a dynamic table widget

## Customize records of peak traffic

Use a [dynamic table widget](https://coralogix.com/docs/user-guides/custom-dashboards/widgets/dynamic-widget/index.md) to track your largest error responses per day and highlight spikes with visual rules. This tutorial guides you through a [projected query](https://coralogix.com/docs/user-guides/custom-dashboards/widgets/dynamic-widget/#projected-queries), demonstrating how to format bytes and highlight high counts using column rules in the table widget.

## What you need

- [Permission](https://coralogix.com/docs/user-guides/custom-dashboards/permissions/index.md) to create and edit dashboards in Custom Dashboards.
- A project that sends logs with `severity`, `http_resp_bytes`, and `timestamp` fields.
- A dashboard where you can add a new dynamic widget.

### Step 1: create the dynamic table widget

1. Open your dashboard, select **Add Widget** and drag a new **Dynamic widget** into the dashboard.

1. In the [Query Builder](https://coralogix.com/docs/user-guides/custom-dashboards/tutorials/query-builder/index.md), select [DataPrime](https://coralogix.com/docs/dataprime/index.md) as the data source and paste this projected query:

   ```text
   source logs
   | filter $m.severity == ERROR
   | groupby $m.timestamp / 10m as bucket.ts agg count() as bucket.count, max($d.http_resp_bytes) as bucket.maxBytes
   | groupby bucket.ts / 1d as day max_by(bucket.count, bucket) as bucket
   | choose day.formatTimestamp('%d-%m-%Y') as day,
            bucket.count as count,
            bucket.maxBytes as largestBytes,
            bucket.ts.formatTimestamp('%d-%m-%Y %H:%M') as ts
   ```

   This query identifies the busiest 10-minute time buckets based on error count per day, and then returns its timestamp, error count, and largest response size.

1. Run the query and switch the visualization to **Table**.

   Note

   The query defines the column names and order in the table. To add new columns or change order, update the query directly. Column Management settings is disabled for projected queries. Learn more about [column management](https://coralogix.com/docs/user-guides/custom-dashboards/widgets/dynamic-widget/#add-and-organize-columns).

1. Confirm that the table shows four columns:

   - **`day`** : The calendar day for the bucket.
   - **`count`**: The number of error events in the 10-minute bucket with the highest error volume.
   - **`largestBytes`**: The largest `http_resp_bytes` value in that day.
   - **`ts`**: The timestamp of that peak bucket.

**How the projected query works**

- The first `groupby` aggregates errors into 10-minute time buckets and calculates two metrics per bucket: `bucket.count` and `bucket.maxBytes`.
- The second `groupby` rolls those buckets up to a per-day view and uses `max_by(bucket.count, bucket)` to keep only the 10-minute bucket with the highest error count for each day.
- The final `choose` projects exactly four fields (`day`, `count`, `largestBytes`, `ts`) into the result. Projected queries expose only these fields to the widget, so the table’s columns always match the projection.

### Step 2: add a rule for the largestBytes column

Use a rule to align the `largestBytes` column and show values as bytes with three decimal places.

1. In the widget’s **Settings**, go to **RULES LIST**, then select **Add rule**.
1. Name the rule **Format largest error size.**
1. Under **Apply on column**, select **Name** and select the `largestBytes` column. The rule now targets only that column.
1. In **Rule properties**, add the following property configuration:
1. **Units** property:
   - Select a **Bytes** unit so the widget formats values like `4.680 KiB`.
   - Set **Decimal** mode with **3** decimal places so small differences in payload size are visible but still readable.

### Step 3: add a threshold rule for the count column

Next, add a rule that highlights days with unusually high error counts in the `count` column.

1. In the **RULES LIST**, select **Add rule**.
1. Name the rule **Highlight error spikes**.
1. Under **Apply on column**, select the **count** column.
1. In **Rule properties**, add the following property configuration:
1. **Threshold** property:
   - **0–3000**: base style (no label)
   - **3000–4000**: warning label at 60%
   - **4000 and up**: critical label at 90%
1. Save the rule. The table uses the thresholds to change the background or badge style for the `count` cells, so days with error spikes stand out immediately.

Threshold rules evaluate the numeric value in the cell. Applying formatting or units to other columns doesn't affect thresholds.

## Analyze the table

- Scan the `count` column first to spot highlighted days with the highest error volume.
- Look at `largestBytes` for those days to understand whether large responses correlate with error spikes.
- Use the `ts` column to drill into the exact 10-minute window where errors peaked, for example by opening an Explore query or a custom action from the row.

## Filter table results

After identifying a row of interest, open the context menu on any cell value to filter the table without editing your query.

- Select **Filter In** to narrow the table to rows that match the selected value.
- Select **Filter Out** to exclude all rows that match the selected value.

Filters appear in the widget filter bar where you can review and remove them.

For full behavior, steps, and limitations, see [Filter table results with Filter In and Filter Out](https://coralogix.com/docs/user-guides/custom-dashboards/widgets/dynamic-widget/#filter-table-results-with-filter-in-and-filter-out).

## Best practices

- Keep projected queries narrow. Use [`choose`](https://coralogix.com/docs/dataprime/language-reference/commands-reference/choose/) to include only the columns you need in the table, which keeps rule configuration focused and column management predictable.
- Use **Units** on any column that represents bytes, durations, or percentages so tables follow consistent measurement styling across dashboards.
- Use **Column alignment** to right-align numbers and left-align text so mixed data types remain readable.
- In production dashboards you can combine **Units**, **Alignment**, and **Thresholds** to take full advantage of column customization.
- Name rules and add descriptions so other team members can understand why a rule exists and which behavior it controls.

## Next steps

Learn how to [create and manage custom actions](https://coralogix.com/docs/user-guides/custom-dashboards/tutorials/create-and-manage-custom-actions/index.md).