Viewing coalesced results


Viewing coalesced results can help you analyze the pattern underlying those results. Coalesced results can be viewed in context of a search.


When you view coalesced results, the product identifies search results containing similar data records and groups them together to display a list of grouped records. These records are sorted by count which means the most frequently occurring records are displayed on the top of the list. You can also sort the list of grouped records by the data pattern associated with the records.

Viewing coalesced results can help you analyze data in a more efficient way and take better decisions while troubleshooting issues.

Suppose while searching, you find 6,000 data records. Out of the 6,000 records, say 4,000 contain the same message, only the IP address varies. When you view coalesced results, you can see one message representing the 4,000 similar messages with the variable text indicated with ellipsis. This can help you identify the pattern in which your search results occur and help you uncover messages that otherwise might go unnoticed.

Use the following information to understand about viewing coalesced results and other functions available with this capability:

To view coalesced results

  1. Navigate to the Search tab and perform a search.
  2. On the top-left of the page, click the vertical three dots (indicating a menu) next to All Data and select Analyze Data.
    The coalesced results are displayed in context of the search performed. You can also view anomalies by turning on the Anomalies setting. For more information, see Detecting anomalies.

How coalesced results can be useful?

Coalesced results can be provide valuable insights into your data, as follows:

  • Identify a pattern of the data produced for a particular search query in the given time range.
  • Determine the noisiest and rarest kinds of data records (or events) important while troubleshooting issues.
  • Find the most common and least common records that form the grouped results.

Understanding coalesced results

When you view coalesced results, the following information is available under the Coalesce tab:

Recommendation

When you navigate to the Coalesce page, the grouped results are displayed progressively.

BMC recommends you to not perform the following actions until the search is completed and all the results are displayed.

Column nameDescription
Count

Displays bars that indicate the number of times the same record occurred for the given time range and the given search query (as shown in the following figure).

By default, this column is sorted in a descending order, which means the most frequently occurring records are displayed at the top of the list. Click the Count column to sort the grouped records in an ascending way.

Click an individual bar to see the top ten and bottom ten records occurring in the grouped record. When you click one of the bars, under the Count column, the top ten records are displayed (as shown in the following figure). To see the bottom ten records, click the three vertical dots menu next to Top Records, and select Show Bottom 10 (by count). Conversely, to return to the top ten records list, click the three vertical dots menu and select Show Top 10 (by count).

The top ten records and bottom ten records provide an idea of the most common and least common messages occurring in the grouped record.

Tip

If you observe the list of bars under the Count column (from top to bottom), you can see the most repeating and the least repeating records.

Type of Data

Displays the data pattern corresponding to each of the grouped records.

Click the Data Pattern column to sort the grouped records by the data pattern so that all grouped records associated with the same data pattern are displayed at the top of the list in an alphabetical order.

This column can be sorted alphabetically in an ascending (A-Z) or descending (Z-A) order.

Coalesced Records

Displays a list of similar search results grouped together based on the data pattern and sorted by count (number of occurrences).

The coalesced records display the common grouped message. In the grouped message, the common text is displayed as it is, while the varying portions of the message are indicated by ellipsis enclosed in square brackets ([...]), as shown in the following figure.

Click  Launch Search next to the message to run a search with the coalesced message and see the results on the All Data page. You can also run a search with the individual (or specific) message from the top 10 or bottom 10 records list.

The number of search results may differ slightly between the following two ways of searching due to the limitations in the search query:

  • When you click Launch Search next to the group of records and drill down on the coalesced results.
  • When you directly search, which contains some additional records.

TrueSight IT Data Analytics includes out-of-box configured fields for TrueSight Infrastructure Management, Remedy Action Request System (ARS) and Windows events. The following default fields are configured for coalescing.

EventsField
TrueSight Infrastructure Managementmsg
Remedy Action Request System - changesDescription
Remedy Action Request System - incidentsDescription
Windowsraw

Changing the matching factor for viewing coalesced data

By default, data is coalesced based on a matching factor of 70%. This means records are grouped based on at least 70% similarity (in other words, maximum 30% variation).

You can change the matching factor by using the matchingfactor CLI command. For more information, see matchingfactor CLI command.

Examples for understanding how data is coalesced

The following examples can help you understand how data is coalesced and displayed based on the matching factor applied.

Example 1: Understanding how coalesced results are displayed if the matching factor is set at 70%

Suppose your data contains the following records:

Sample data records

A quick brown fox jumps over the lazy black dog

A quick brown fox jumps over the little white cat

If you set the matching factor to 70%, you can expect to see the following coalesced record:

Coalesced record (with coalescence factor set at 70%)

A quick brown fox jumps over the [...] [...] [...]

Example 2: Understanding how coalesced results are displayed if the matching factor is set at 80%

Suppose your data contains the following records:

Sample data records

A quick brown fox jumps over the lazy black dog

A scary brown wolf jumps over the lazy black dog

If you set the matching factor to 80%, you can expect to see the following coalesced record:

Coalesced record (with coalescence factor set at 80%)

[...] brown [...] jumps over the lazy black dog

Example 3: Understanding how matching results displayed differ based on the matching factor

Suppose your data contains the following records:

Sample data records

A quick brown fox jumps over the lazy black dog

A scary brown wolf jumps over the lazy black dog

A quick brown fox jumps over the little white cat

A quick brown fox jumps over the lazy white dog

Scenario 1: Matching factor set at 70%

With the matching factor set to 70%, you can expect to see the following coalesced record.

The following coalesced record is expected to have a count of 4. This means the following coalesced record contains 4 messages that are 70% similar.

Note that in this scenario, if you change the matching factor to 60%, you can expect to see the same results.

Coalesced record (with coalescence factor set at 70%)

A [...] brown [...] jumps over the [...] [...] [...]

Scenario 2: Matching factor set at 80%

With the matching factor set to 80%, you can expect to see the following coalesced records.

The first coalesced record is expected to have a count of 3, while the next one is expected to have a count of 1. This means the first coalesced record contains 3 messages that are 80% similar.

Coalesced record (with coalescence factor set at 80%)

A [...] brown [...] jumps over the lazy [...] dog

A quick brown fox jumps over the little white cat

Scenario 3: Matching factor set at 90%

With the matching factor set to 90%, you can expect to see the following coalesced records.

The first coalesced record is expected to have a count of 2, while the second and the third ones are expected to have a count of 1. This means the first coalesced record contains 2 messages that are 90% similar.

Coalesced record (with coalescence factor set at 90%)

 A quick brown fox jumps over the lazy [...] dog

A scary brown wolf jumps over the lazy black dog

A quick brown fox jumps over the little white cat

Was this page helpful? Yes No Submitting... Thank you

Comments