Tableau 2020.2 released a long waiting Metrics feature. Metrics make it easy to monitor key performance indicators from web or Mobile. It is super easy to create. When you use Tableau Mobile to check Metrics, you can update trend line data range and even compare measures with time frames.
Marc Reid(Zen Master)’s dataviz.blog has a nice summary about how to use Metrics. This blog talks about how Metrics works on Tableau server to answer the following questions:
- Who can create Metrics
- What is entry point to create Metrics
- What is the relationship between Metrics and its connected view
- How Metrics permission works
- How metrics is refreshed
- What are the differences between Metrics and subscription/Data-driven alert
- How to find out Metrics usage
- Can I turn off Metrics for site, project or workbook
- Is there Metrics revision
Who can create Metrics
Only Publishers can create Metrics.
Metrics authoring is actually a publishing process, similar as save Ask Data results to server or workbook publish. The Metrics author has to have ALL the following 5 things to create a Metrics:
- Site role as Creator or Explorer (can publish)
- Publisher permission to a project on server/site
- v2020.2-2021.2 (Download Full Data permission) to the view. v2021.3 onwards, Create/refresh Metrics permission
- The workbook has embedded password
- The workbook has no row level security or user filter
What is entry point to create Metrics?
View or Custom View are the only entry point to create Metrics unlike Ask Data using Data Source as entry point.
What is the relationship between Metrics and its connected view ?
Metrics is created from a view. However soon as Metrics is created, it becomes more like ‘independent’ object that has its owner and its own permission. Metrics will still stay on server when connected view is deleted although Metrics can’t be refreshed anymore. This is very similar as relationship between Published Data Source and connected workbook.
How Metrics permission works?
For those who know me, I spent hours or hours to test/validate Tableau permissions. Here is how Metrics permission works:
- Metrics has its own independent permission
- Metrics permission is controlled by Metrics owner and the project leader where Metrics is published
- Metrics owner decides who can access/overwrite the Metrics.
- Metrics owner can grant permission to any Explorer who does not have the original connected view permission at all. This is an important behavior to be aware of, similar as published data source and its connected workbook permission process (like it or not)
- For example, John’s dashboard granted Allan permission. If Allan is a publisher on the server, Allan can create a Metrics and grant 1,000 other user’s access to the Metrics without John’s approval, or even without John’s knowledge.
- An important behavior: John, as workbook owner, has a new Connected Metrics tab to have visibility on Metrics. However if Allan does not grant John access to the Metrics, John would have no idea at all such Metrics connected with his view (yes, that is how the permission works, similar as connected workbook with published data sources)
Can I turn off Metrics for site, project or workbook?
If there is data security concern that you want to turn off Metrics. Here is how:
- Metrics can be turned OFF at site level although default is ON – admin goes to site setting for the flag
- There is no feature to turn off Metrics at project level. But my tip is to set project permission such way to uncheck Download Full Data for workbooks and LOCK the project permission . This way none of the workbooks can be used to create Metrics
- There is no feature to turn off Metrics at view level or workbook level. However as long as you do not give Download Full Data permission, Metrics can’t be created
How Metrics is refreshed?
- Live connection: Refresh hourly
- Extract: After each extract run. This is handled by Tableau server backgrounder new ‘Update all metrics in the view‘ process.
- Server admin can change Live connection refresh interval (metricsservices.checkIntervalInMinutes) – default value is 60 min.
How Metrics refreshes handles warnings and errors?
If Metrics refresh failed 10 times in the row, Tableau server will send notification email to Metrics owner. This 10 time can be configured- If Metrics refresh failed 175 times in the row, Tableau server will stop refresh. Metrics owner has to manually resume the refresh after problem solved.
How to find out Metrics usage?
- Built-in feature, similar as find view usage
- Admins can also find usage details from admin views.
Is there Metrics revision?
No unlike workbook or data sources. If you need new version of a published Metrics, you can replace existing one if you are owner, project leader or user who has overwritten permission. Metrics permission will remain unchanged after Metrics is replaced with a new revision. If you save new Metrics as different name, it will be a complete a new Metrics. You can create many Metics from the same view. You can’t combine two view’s measures into the same Metrics. As matter of fact, Metrics handle only single measure.
Re-cap:
- Metrics is great new Tableau innovation to track KPIs instantly and on Mobile.
- Metrics is created from an existing view on server and refresh hourly for live connection or whenever extract refresh for view using extract.
- You can’t create Metrics from Desktop.
- Metrics can create new potential data access or data governance challenge due to the fact that one can create a Metrics and grant anyone else access permission without approval or knowledge from original workbook/view owner. This is very different from Data-Driven Alert or Subscription that follow the exact view permission.
- Today it is hard enough already to audit “who has what access” for a team/project with many workbooks. This Metrics feature will make this problem worse although Metrics is a great feature.
- Workbook has a new Connected Metrics tab but if Metrics owner did not give workbook owner the Metrics access permission, workbook owner will not know the Metrics exists although the Metrics may be shared to many other server users….
- Do not get me wrong. My intent is not to disencourge you to use Metics. Actually I do strongly encourage everyone to use it. However my point is to make sure admins/project leader/publishers full aware of the permission and data security behavior so you can put necessary controls to avoid potential data security chaos.
- What are the potential controls? Some ideas from Mark:
- For very sensitive data, put the workbooks into separate project, lock project permission and do not give Download Full Data permission to any of the workbooks
- For one or a few sensitive workbooks, if you do not use lock project permission approach, you can control workbook level permission as well – not giving Download Full Data
- Again, repeating…. For very sensitive workbooks, if you use v2020.2-2021.2, I strongly recommend to lock the Project permission and do not give Download Full Data permission so Metrics can’t be created.
- If your server is v2021.3 or newer, you do not have potential metrics permission cascading issue anymore. Read https://enterprisetableau.com/metrics2/
- Data Catalog – data lineage does not include Metrics data yet as v2020.2 release. But as I know that Tableau Dev is working on it.
- Enjoy cool Metrics!!!!!
your tableau sevices blog is good
One point to add..you can also restrict metrics publish only to the project on which user has publish permission so if a user has publish capability to few projects and on that projects permissions are locked ,metrics owner can’t grant other’spermission.
Idea is to have a central folder and in that central folder only through automated process and approvals publish is done.Users only have view access to reports in central folder and no publish permission .Permissions on central folder are not locked to project so to maintain each workbook its own permission.
Users personal project to have only the publish permission with permissions locked.
Agreed w Rajeev. Creating Metrics is a publishing activity and user has to have a project to publish to in additional to creator or Explorer(can publish) site role.