Workbench 0.18 User Guide

Object Explorer

Data Set

Overview

A data set is a group of related files of the same type.  A typical data set would be the files that make up a Wireshark or Process Monitor ring buffer.  Aside from allowing us to collect files into handy groups, Workbench enables a tool to operate on a data set in the same way as it may operate on a file.  In practice this means that you can drag a data set onto the workpad, and then drag and drop a tool onto that set.

Add Data Set

To add a data set to a data type container, right-click on the data type container label and choose Add Data Set.

Add a file set

The new data set is added with a default name of Dataset.

Add Directory Data Set

A directory data set is like a data set but with two important differences: 

  • Adding a directory data set adds all files in the directory rather than just those selected
  • The individual files are never shown in the Object Explorer in the way that the members of a data set are

You may wonder why we would ever want to use a directory data set.  There are times when we will never perform detailed analysis on a whole set of files.

Add a directory file set

A good example is when we have a group of files that make up a ring buffer.  In this case, a workflow will probably start by filtering the ring buffer to produce a single trace file with just those packets associated with one PC or server that fall within a narrow time range.  The Workbench Filter function can filter a directory data set in this way.

Select a directory to add

To add a directory file set:

  • Right click on a data type container
  • Choose Add Directory Data Set
  • Browse for the folder (directory) to add
  • Click OK

Rename

Rename a directory file set

A data set or a directory data set can be renamed in any of three ways: 

  • Double-click on the set label to produce an editable version
  • Click on the set and press F2
  • Right-click on the set label and choose Rename from the menu

To save the new name hit the Return button on your keyboard.

Delete

A data set or a directory data set can be deleted in two ways:

  • Click on the set so it is highlighted and then press the Delete key
  • Right click on a set and choose Delete

Properties

You can view the properties of a data set or a directory data set in three ways:

  • Click on the set so it is highlighted and then press Alt-Enter
  • Right-click on the set and choose Properties
  • Use View -> Properties Window to display properties, float or dock the window so that the Object Explorer is visible and then click on the set