Issues Visualization
Issues visualization helps you to identify new issues in your logs in the selected time range. These are the issues found in the selected time range but are not present in the baseline time range, typically last 12 hours, specified for the analysis.
Issues visualization analyzes the logs in the following order:
-
It creates clusters of log records by grouping similar log records. To know more about clustering, see Clusters Visualization.
-
The clusters that are common in both the time ranges are removed.
Next, it applies the cluster compare utility to draw the comparison between the unique clusters in the two time ranges. For more information on how cluster compare works, see Use Cluster Compare Utility and clustercompare.
-
In the remaining log records, only those that have keywords related to issues like error or exception, or labels related to issues are displayed. You can customize your sources to add new labels and problem priority indication to your logs using the label definitions in the source. See Use Labels in Sources.
Baseline time: This is the time range that best groups the typical set of logs that your system would generate. Select the time range that captures the entire cycle of log generation, for example, 8 hours, 12 hours, 1 day, or 5 days. Longer baseline range may result in longer time to run the query.
Time range for analysis: This is the time range that has the logs of your interest for analysis. Use the time selector to identify this range.
How is the comparison scope identified: Based on your selection of the baseline time and the time range of the logs for analysis, first the time range for analysis is fixed. Next, the baseline range is located to precede the time range of analysis.
For example, If you select the analysis time range as Last 60
minutes, and the baseline range as 12 hours, then:
|=================================|========================|
Baseline Time Range | Analysis Time Range
12 hours before Last 60 minutes | Last 60 minutes
Example: 8AM - 8PM Today | 8PM - 9PM Today- From the Visualize panel, select Issues (
). - Select the baseline time range. From the Options menu, click Search
options, and select the time range in hours or days from
the menu. For example
1 day.You can now view the issues analysis of your logs for the selected time range:
In the above example, 1 new issue is found. Expand the row in the table to view the histogram. The cluster sample provides the sample log record from the log message signature for the cluster in which the issue is detected.
In addition to new issues, you can also know about the New Outliers found in the selected set of logs. Outliers are the log records that occurred only once in the current range and not occurred in the baseline. An outlier may or may not be an issue.
The visualization summarizes the number of log records used in the analysis, total number of unique clusters identified, and the number of log sources in which issues were detected.
By default, the Show Issues option is selected for the table. You can select Show Outliers to view the details of the outliers found in the clusters.