Page tree
Skip to end of metadata
Go to start of metadata

Viewing coalesced results can help you analyze the pattern underlying those results. Coalesced results can be viewed in context of a search.

When you view coalesced results, the product identifies search results containing similar data records and groups them together to display a list of grouped records. These records are sorted by count which means the most frequently occurring records are displayed on the top of the list. You can also sort the list of grouped records by the data pattern associated with the records.

Viewing coalesced results can help you analyze data in a more efficient way and take better decisions while troubleshooting issues.

Suppose while searching, you find 6,000 data records. Out of the 6,000 records, say 4,000 contain the same message, only the IP address varies. When you view coalesced results, you can see one message representing the 4,000 similar messages with the variable text indicated with ellipsis. This can help you identify the pattern in which your search results occur and help you uncover messages that otherwise might go unnoticed.

Use the following information to understand about viewing coalesced results and other functions available with this capability:

To view coalesced results

  1. Navigate to the Search tab and perform a search.
  2. On the top-left of the page, click the vertical three dots (indicating a menu) next to All Data and select Analyze Data.
    The coalesced results are displayed in context of the search performed. You can also view anomalies by turning on the Anomalies setting. For more information, see Detecting anomalies.

How coalesced results can be useful?

Coalesced results can be provide valuable insights into your data, as follows:

  • Identify a pattern of the data produced for a particular search query in the given time range.
  • Determine the noisiest and rarest kinds of data records (or events) important while troubleshooting issues.
  • Find the most common and least common records that form the grouped results.

Understanding coalesced results

When you view coalesced results, the following information is available under the Coalesce tab:

Recommendation

When you navigate to the Coalesce page, the grouped results are displayed progressively.

BMC recommends you to not perform the following actions until the search is completed and all the results are displayed.

Column nameDescription
Count

Displays bars that indicate the number of times the same record occurred for the given time range and the given search query (as shown in the following figure).

By default, this column is sorted in a descending order, which means the most frequently occurring records are displayed at the top of the list. Click the Count column to sort the grouped records in an ascending way.

Click an individual bar to see the top ten and bottom ten records occurring in the grouped record. When you click one of the bars, under the Count column, the top ten records are displayed (as shown in the following figure). To see the bottom ten records, click the three vertical dots menu next to Top Records, and select Show Bottom 10 (by count). Conversely, to return to the top ten records list, click the three vertical dots menu and select Show Top 10 (by count).

The top ten records and bottom ten records provide an idea of the most common and least common messages occurring in the grouped record.

Tip

If you observe the list of bars under the Count column (from top to bottom), you can see the most repeating and the least repeating records.

Type of Data

Displays the data pattern corresponding to each of the grouped records.

Click the Data Pattern column to sort the grouped records by the data pattern so that all grouped records associated with the same data pattern are displayed at the top of the list in an alphabetical order.

This column can be sorted alphabetically in an ascending (A-Z) or descending (Z-A) order.

Coalesced Records

Displays a list of similar search results grouped together based on the data pattern and sorted by count (number of occurrences).

The coalesced records display the common grouped message. In the grouped message, the common text is displayed as it is, while the varying portions of the message are indicated by ellipsis enclosed in square brackets ([...]), as shown in the following figure.

Click  Launch Search next to the message to run a search with the coalesced message and see the results on the All Data page. You can also run a search with the individual (or specific) message from the top 10 or bottom 10 records list.

Changing the coalescence factor for viewing coalesced data

By default, data is coalesced based on a coalescence factor of 70%. This means records are grouped based on at least 70% similarity (in other words, maximum 30% variation).

On the Coalesce tab, the slider on the top-right of the page can help you change the coalescence factor and view results differently based on the coalescence factor applied. The coalescence factor controls the amount by which the grouped records must vary.

As you move the slider from left to right, the variation used to group records becomes lesser and the similarity increases (as shown in the following figure). In other words, the grouped records contain individual records that are more similar. Therefore, when you move the slider towards the right, you can see more results as compared to moving the slider towards the left.

Note

Changing the coalescence factor can impact the results that you see if you are watching anomalies. If you change the coalescence factor, and then check for anomalies, you will notice that the matching factor slider is also set at the same level. For example, if the coalescence factor is set at 80% similarity, the matching factor (for anomalies) is automatically set at 80%. To be able to view more accurate results, it is recommended that you keep the coalescence factor and the matching factor at the same level.

The coalescence factor can affect the results displayed in the following way:

ActionVariationSimilarityTotal number of results
Move the slider from left to rightLessMoreMore
Move the slider from right to leftMoreLessLess

Examples for understanding how data is coalesced

The following examples can help you understand how data is coalesced and displayed based on the coalescence factor applied.

Example 1: Understanding how coalesced results are displayed if the coalescence factor is set at 70%

Suppose your data contains the following records:

Sample data records

A quick brown fox jumps over the lazy black dog

A quick brown fox jumps over the little white cat

If you set the coalescence factor to 70%, you can expect to see the following coalesced record:

Coalesced record (with coalescence factor set at 70%)

A quick brown fox jumps over the [...] [...] [...]

Example 2: Understanding how coalesced results are displayed if the coalescence factor is set at 80%

Suppose your data contains the following records:

Sample data records

A quick brown fox jumps over the lazy black dog

A scary brown wolf jumps over the lazy black dog

If you set the coalescence factor to 80%, you can expect to see the following coalesced record:

Coalesced record (with coalescence factor set at 80%)

[...] brown [...] jumps over the lazy black dog

Example 3: Understanding how coalesced results displayed differ based on the coalescence factor

Suppose your data contains the following records:

Sample data records

A quick brown fox jumps over the lazy black dog

A scary brown wolf jumps over the lazy black dog

A quick brown fox jumps over the little white cat

A quick brown fox jumps over the lazy white dog

Scenario 1: Coalescence factor set at 70%

With the coalescence factor set to 70%, you can expect to see the following coalesced record.

The following coalesced record is expected to have a count of 4. This means the following coalesced record contains 4 messages that are 70% similar.

Note that in this scenario, if you change the coalescence factor to 60%, you can expect to see the same results.

Coalesced record (with coalescence factor set at 70%)

A [...] brown [...] jumps over the [...] [...] [...]

Scenario 2: Coalescence factor set at 80%

With the coalescence factor set to 80%, you can expect to see the following coalesced records.

The first coalesced record is expected to have a count of 3, while the next one is expected to have a count of 1. This means the first coalesced record contains 3 messages that are 80% similar.

Coalesced record (with coalescence factor set at 80%)

A [...] brown [...] jumps over the lazy [...] dog

A quick brown fox jumps over the little white cat

Scenario 3: Coalescence factor set at 90%

With the coalescence factor set to 90%, you can expect to see the following coalesced records.

The first coalesced record is expected to have a count of 2, while the second and the third ones are expected to have a count of 1. This means the first coalesced record contains 2 messages that are 90% similar.

Coalesced record (with coalescence factor set at 90%)

 A quick brown fox jumps over the lazy [...] dog

A scary brown wolf jumps over the lazy black dog

A quick brown fox jumps over the little white cat