Content packs serve as a ready-made collection of components that extend the capabilities of using the TrueSight IT Data Analytics product. Content packs are a collection of components such as saved searches, data patterns, collection profiles, and dashboards that you can use to support a particular use case or for solving a particular issue.
The IT Data Analytics product provides a set of content packs that you can download from the BMC Software Electronic Product Distribution (EPD) website and start using immediately. Examples include content packs for monitoring the Oracle database logs, Citrix XenApp logs, and so on. For more information, see Supported content packs in the TrueSight IT Data Analytics content packs online documentation portal.
The following video (9:41) illustrates how to create a content pack for IT Data Analytics.
The following video displays screens from an earlier version, however, the information provided in the video is still relevant to the current version of the product.
The following information describes the basic concepts and the process of creating and using content packs.
You can use content packs in the following ways:
The product automatically extracts name=value pairs existing in the saved search queries as a list of macros while exporting a content pack. You can browse through list of saved searches to see the macros available. These macros are only available if the saved search query contains name=value pairs.
You can select the macros, change the values, and then export the content pack. The exported content pack will contain the new values substituted at the time of performing the export.
The macros selected at the time of performing the export can again be changed at the time of importing the content pack. However, you can only change those macros that were selected at the time of exporting the content pack.
Components imported via a content pack cannot be modified. However, you can clone the component and then customize it as per your needs. Note that by cloning a component, you are creating a private copy of that component. This means when a new version of the same content pack is imported, the cloned copy of the component will not be dynamically updated with the latest changes.
You can customize content packs in the following ways:
When you import a content pack, the components included in that content pack are automatically listed on the individual components pages. For more information, see About components imported via a content pack.
Also, the name, description, and version information cannot be modified. This feature can help you manage, monitor, and control the revisions made to the content packs in your environment.
Click Preview to preview the file contents.
Navigate to one of the following tabs to verify that the components are successfully imported:
|Data patterns||Administration > Data Patterns|
|Collection profiles||Administration > Collection Profiles|
|Saved searches||Saved Searches|
You can use this feature to create a new content pack. This feature also allows you to create a copy of an existing content pack. By creating a copy of an existing content pack, you can customize it to suit your needs. The customized copy can then be exported as a new content pack.
Content packs can be created (or exported) by the app admin or the super admin. The person creating the content packs is known as the content pack author. Content pack authors are assumed to possess in-depth knowledge of the domain around which they create content packs.
To create a new content pack or to create a copy of an existing content pack, you need to select the components that you want to bundle together, and then export it as a zipped file.
Each time you create a content pack with the same name, a new version is created. This version is based on the version that you provide while exporting the content pack. The content pack name and version play an important role in providing revision control over the content packs in your environment.
Note that components included in a content pack are not editable when imported. This feature allows the content pack author to update an existing content pack with changes and release new versions of the same content pack. This feature also allows the content pack author to exercise revision control.
Name: Provide a name to identify the content pack.
BMC recommends you to use a uniform convention for providing a name for the content pack. This is important because content packs can be easily shared and customized and therefore can be difficult to maintain over time.
While deciding the naming convention, you need to ensure that the name is both easily identifiable and will not need to be changed again.
The naming convention can be decided based on various parameters. However, the most common parameters are as follows:
Description:(Optional) Provide additional information such as the purpose of exporting the content pack.
Version: Specify a unique name or number to make the content pack easily identifiable in the future. By assigning a version, you can keep track of incrementally different versions of the same content pack in the future.
To implement revision control, it is important that you use a uniform convention while specifying the content pack version.
Minimal Required Product Version: Select one of the IT Data Analytics product versions to set the minimal product version to import the content pack. After this value is set, you cannot import the content pack on a product version lower than the minimal required version set. By default this value is set to the current version of the product.
Select the components (such as saved searches, data patterns, dashboards, and collection profiles) that you want to export.
Default data patterns cannot be included in a content pack.
Search for a component by entering the component name or the content pack name in the search box and click Search Components.
You can view the details of a component by clicking it.
While using the Safari browser, it is possible that the exported zipped file is automatically extracted.
In this case, you need to change the browser preferences to disable automatic extraction of downloaded zipped files. To do this, navigate to Preferences and under the General tab, clear the selection next to Open “safe” files after downloading.
Components imported via a content pack can be used by all the users irrespective of their role. Note that saved searches imported via a content pack are treated as public saved searches.
Components imported via a content pack can be accessed on the particular component pages. For example, saved searches are listed on the Saved Searches page, data patterns are listed on the Administration > Data Patterns page, and so on. The individual component pages display the content pack name so that you can distinguish between components created by you and components imported via a content pack.
In the process of configuring an object by selecting a component (saved search, data pattern, dashboard, or collection profile), you can easily identify that the component is imported via a content pack because the component name is suffixed with the content pack name in square brackets. Thus, the component name is displayed in the format, ComponentName [ContentPackName].
The following examples describe this scenario:
Components imported via a content pack are not editable. Note that importing a new version of the same content pack can impact the components available in your system.
If an existing content pack is deleted and components imported by that content pack are in use, those components are removed from the content pack. Additionally, a private copy of the removed components is automatically created and the user using those components becomes the owner of the private copy. A private copy ensures smooth functioning of the objects dependent on the components. The components that are not in use are automatically deleted with the content pack deletion.
When you import an updated version of an existing content pack, the following scenarios can occur:
The new components included in the content pack are automatically listed on the individual component pages.
The following table describes the impact of making updates to an existing content pack. This includes the impact of excluding a component in the content pack.
|Dashboards and collection profiles|
These components are independent entities. This means they are not used in the process of configuring other objects.
If the new version of a content pack does not include some dashboards or collection profiles (that were present in the earlier version), then such dashboards and collection profiles are automatically deleted. Similarly, dashboards and collection profiles are automatically updated with the new changes available with a content pack update.
Note that with a content pack update, any changes made to the collection profile (including deletion) does not impact the data collectors created by using that collection profile.
Saved searches and data patterns
|These components can be linked with other entities. Saved searches can be used in dashboards and notifications. Similarly, data patterns can be used in data collectors and collection profiles. |
Depending on whether these components are in use at the time of a content pack update, the changes can be different. This is explained as follows:
The Content Packs tab allows you to manage imported content packs. To access this tab, navigate to Administration > Content Packs. From here, you can perform the following actions:
|Import Content Pack|
Import a content pack into your current TrueSight IT Data Analytics instance.
For more information, see Importing a content pack.
|Export / Create Content Pack|
Export the selected saved searches, data patterns, dashboards, and collection profiles (as a zipped file) from your current IT Data Analytics instance.
You can also use this feature to create a copy of an existing content pack. You can create a copy by selecting an already imported content pack and clicking Export / Create Content Pack. Then, you can customize the copy and export a new copy with the changes.
For more information, see Exporting a content pack.
|View Content Pack||View details of the selected content pack.|
|Delete Content Pack|
Delete the selected content pack.
When you delete a content pack, the dashboards and collection profiles imported via the content pack are automatically deleted. Other components such as saved searches and data patterns are deleted based on whether they are in use.
Saved searches can be used in notifications or dashboards and data patterns can be used in data collectors or collection profiles. If the saved searches or data patterns are not in use then they are automatically deleted.
If the saved searches are found to be in use during the content pack deletion, those saved searches are removed from the content pack and a private copy of the original saved searches is automatically created. The private copy is named as, "Copy of <ComponentName> from <ContentPackName>". The user using the saved searches becomes the owner of the private copy. Thus, if there are multiple users using such saved searches, then multiple copies of the saved searches are created.
Similarly, if the data patterns are found to be in use during the content pack deletion, those data patterns are removed from the content pack and a copy of the original data patterns is automatically created. The copy is named as, "Copy of <ComponentName> from <ContentPackName>". By default, the copy is available to all users irrespective of their role.
Creation of a private copy ensures smooth functioning of the objects dependent on the saved searches (or data patterns).
Note: If the data pattern name was used in a saved search query, that query is not automatically updated.
The Content Packs tab provides the following information:
|Name||The name of the imported content pack.|
|Description||The description of the imported content pack.|
|Version||The version assigned to the content pack at the time of exporting (or creating) it.|