Investigating ML-based situations

As a tenant administrator, you can view and investigate situations and perform additional event actions based on your user role to:

• Close all ML-based situations

• Create incidents in BMC Helix ITSM – SmartIT
• Remediate open or assigned events (requires enabling the Intelligent Automations feature)

To view and investigate a situation

As a tenant administrator, you can investigate situations as the need arises.

1. Click Situations. 
2. If using the tile view, on a Situation tile, click Investigate to view the following details:
   
   • Situation name, summary of the situations in natural language, severity, incident ID (if available), status, last modification date, and number of events grouped by the top three host names
   • Correlation event details such as event message, the impacted host, occurrence, severity, priority, and status
3. If using the list view, click the Situation name to view the situation details.
   Situation details such as severity, status, highlights are shown. For ML-based Situations, the impacted service name is also displayed. 
4. (Optional) To create an incident for the situation, if not created yet, click Create Incident.
   An incident is created in BMC Helix IT Service Management and the incident ID appears for the situation. If you have the required permissions, you can click the link to view the incident details in BMC Helix IT Service Management – Smart IT. 
5. To perform additional actions for a Situation, click and perform any of the available actions. 
   
6. (Optional) To customize the columns that appear here, click the column selector and clear the columns that you do not want to appear.
   Only selected columns are displayed. You can also drag and drop the columns to rearrange them based on your requirement.  

7. (Optional) Change the View Type to either Flat or Hierarchical.
   The flat view type is selected by default, where the events are listed in a sequence.
   A hierarchical view groups events within events based on event signatures to give a better organized presentation of events as show in the following image:

   Grouping events

   Event signature grouping is based on the host name and event messages.

   

8.  In the Automations column, automations that match the event are displayed.
9. To run automations, see Remediating events for services and situations. 
10. (Optional) You can also request for creating automations or if you have the permissions, create automations for events. 
11. Click Action to view and perform any of the supported actions for the event. 
    To perform event actions, see To perform event actions.
    
12. Click any event message to view the following event details: 
    • Event name, severity, priority, and status
    • Event assignee details
    • Date when the event first occurred or was last modified

    • Event class details. For more information, see  EVENT base event class.

    • Performance View tab: If the event slot value for the Class is Alarm, the tab displays the time-series data collected from key the attributes of the causal events of ML-based situations.

    • Click More Details to open the event details page in BMC Helix Operations Management. 

      
      
      

13. (Optional) Click Close Situation if its status is Open or Assigned, and Click Yes.

    All the correlated events except the alarm events are closed. The Situation status changes to Closed. You can close a situation even if the incident created for the situation is not closed.

To perform event actions

The capabilities available for your organization and your user role determine the event actions that you can perform. 

The following table describes the basic event actions. For more information about the impact of the actions on the event, see Performing event operations  in the BMC Helix Operations Management online documentation.