2.0.00 enhancements

This section contains information about enhancements in version 2.0.00 of the BMC TrueSight IT Data Analytics product.

Comparing search results

With version 2.0.00, you can compare the summary of search results displayed in the form of a timeline chart across different time contexts. The search query and time interval (search duration) that you select remain the same, but the time context changes to the previous day, the previous week, and so on. Access this feature from the Search > All Data page by clicking the three vertical dots next to All Data and selecting Compare Data. For more information, see Compare results.

CLI command enhancements

The following new commands are added:

The following changes are made to the existing commands:

Content pack enhancements

The following enhancements are added:

• While exporting a content pack, you can set the minimal compatible version of the product. You cannot import the content pack on a product version that is earlier than the minimal compatible version.

• While importing a content pack, you can perform the following actions:
  • You can rename a content pack and also change the description of the content pack.
  • You can see whether there are any components that are already present in the system.

• When you preview a content pack, it's components are displayed in alphabetical order.

• The imported content packs are displayed in alphabetical order.
• Content pack artifacts, such as saved searches, data patterns, views, and collection profiles, are now known as components. Note that beginning with version 2.0.00, views are known as dashboards and viewlets are known as dashlets.

Data collection enhancements

The following enhancements are added for data collectors, which are available on the Administration > Data Collectors tab:

Area	Changes	Additional information
Receive over TCP/UDP data collector	During creation of the Receive over TCP/UDP data collector, the following fields are populated with default values: Protocol: UDP Port: 514 Pattern: Syslog	Receive over TCP/UDP
Details regarding the list of data collectors configured	The following changes apply to the Data Collectors page: The following additions apply: A new column Last Event Timestamp is added. This column indicates the timestamp of the last event that was indexed by the particular data collector. A new column State is added. This column indicates the data collector state, such as whether the data collector was started or stopped. The following changes apply: The Status column is now renamed to Polling Status. The Action column is no longer available. The name of the dialog box that shows the status of the last 10 polls has changed to Collection Status History.	Viewing and searching configured data collectors
Starting and stopping data collectors	You can start or stop multiple data collectors simultaneously by using the Start Data Collector(s) and Stop Data Collector(s) icons available on the Data Collectors page. In earlier versions, these icons were displayed next to each data collector under the Action column, and provided the capability of starting or stopping individual data collectors. With version 2.0.00, these icons have been moved to the top of the page and can be used for starting or stopping multiple data collectors simultaneously.
Collection status history	The collection status history can be viewed by selecting one of the data collectors and clicking Collection Status History . With version 2.0.00, the collection status history provides additional details related to the count of records that were successfully indexed, rejected, and ignored. Also, you can see additional details for the last 10 polls. These details provide advanced information about each of the polls, such as the number of records indexed in the polls, the number of bytes indexed, the date and time when the polls were made, the time taken to make the poll, and so on.	Data collection status
Overall data collection status	The overall data collection status, available under the Poll Status column, is displayed based on some additional parameters. These changes are as follows: If no data is received for one hour from the time of the last poll, even if the last five consecutive polls were successful, the overall status appears yellow. This status means that a few polls were unsuccessful. The Receive over TCP/UDP data collector provides the overall polling status based on the most recent individual poll status. However, if no data is received for one hour from the time of the last poll, the overall status appears yellow, which means a few polls were unsuccessful. If the Collection Agent (or Collection Station) used for creating the data collector is disabled, the status shows as gray, which indicates polling is suspended.
Simplified detection of matching data patterns	While creating a data collector, auto-detection of matching data patterns and previewing results is simplified in the following ways: You can find matching data patterns and also preview sample records by clicking the Auto-Detect button. You can filter matching patterns with or without the timestamp. If you choose to find matching data patterns without the timestamp, in the Event Delimiter box, you can provide a string or regular expression to distinguish records. This string or regular expression marks where a new record starts in the data. This string or regular expression must correspond to some text that appears at the beginning of a new line. When you select a data pattern, the corresponding date format is updated automatically.	Creating data collectors (see individual data collector pages listed)
Type-ahead suggestions for tag values	Type-ahead suggestions are available for specifying tag values while you are creating data collectors. These suggestions are based on tag values that you specified in the past. These suggestions are also available while you are creating hosts and collection profiles.
Searching for data collected	After creating a data collector, you can click the Show Data Collected icon that appears next to the data collector to search for the data collected by that data collector.	Viewing and searching configured data collectors
Advanced options for collecting data via scripts	If you are using a custom script to collect data and that script requires the poll interval information, you can pass the poll interval information as an argument to the script. This feature is available for the following data collectors: Monitor script output on Collection Agent Monitor script over SSH	Monitor script output on Collection Agent
		Monitor script output over SSH
	You can run binary script files to collect data over an SSH connection.	Monitor script output over SSH

Discontinued support

Beginning with version 2.0.00, the following features are no longer available.

Documentation updates

The following list provides a list of the major documentation updates:

• The search information section is revamped. You can see all the information regarding search under one section.
• The information regarding how to create various kinds of data collectors is available under the Creating data collectors section.
• The information regarding how to create a data pattern is available on the Creating data patterns manually page.
• The topic providing information about notifications is designed to match the UI page structure.
• The topic on searching the data covers all methods of performing a search.
• The data pattern examples provide a visual representation of steps. For more information, see Examples of creating a data pattern.

Improved user experience

The following enhancements are added to simplify the product UI and improve the user experience:

• The search bar has been moved to the center of the Search page and the quick access items are no longer available. The graph displaying the data indexed over the last week is now on the Default dashboard page. Unlike earlier versions, this graph displays data for the last 24 hours instead of the last 7 days. For more information, see Understanding the Default dashboard page.
• The Cabinet tab is renamed to Saved Searches and provides a list of all the saved searches that were created. For more information, see Managing saved searches.
• The Views tab is renamed to Dashboards and the viewlets are known as dashlets. For more information, see Managing dashboards.
• The Event Route label is renamed to Notification Destination(s). For more information, see Managing notifications.
• The Default dashboard page is set as the default product landing page. This page contains charts that help you analyze the data collection aspect in various ways. The product metrics chart displayed on the Search landing page has been moved to Default dashboard page. This chart now displays data for the last 24 hours instead of the last 7 days. For more information, see Understanding the Default dashboard page.
• You can now set custom dashboard pages as the product landing page. For more information, see Managing user settings.

• A new column, Version, is added on the Administration > Hosts tab. This column displays the version of the Collection Station or Collection Agent that was used when you created the host. For more information, see Managing hosts.
• Super admin users and app admin users can now view external configuration objects created by other super admin users or app admin users. Furthermore, super admin users can also edit external configurations created by other super admin users.
• Type-ahead suggestions are available for specifying tag values when you create data collectors, hosts, and collection profiles. These suggestions are based on tag values that you have specified in the past.
• Tabular commands, by default, display results in the chart view. Also, these commands provide simplified comparison options that help you compare the results (summarized as a chart) across different time contexts, such as previous day, previous week, and so on. For more information, see Tabular commands.

• Graphs on various pages of the product are capable of displaying legends. By default, the legend is hidden so that you can see a larger view of the graph. To display the legend, you need to select the Show Legend check box.
  This feature applies to graphs displayed in the following areas:

  Area	Additional information
  Graph displaying the data indexed over the last week on the Search tab.	Default dashboard page
  Summarization chart displayed in the search results area.	Using the timeline and summarization charts
  Chart View and Compare View displayed for tabular commands.	Search commands
  Dashlets displaying graphs based on tabular commands.	Actions available for dashboards and dashlets

Installation enhancements

With this version, you can perform the following functions:

Integration with BMC TrueSight Operations Management

Beginning with version 2.0.00, you can integrate with BMC TrueSight Operations Management 10.0. With this integration, you can cross-launch from BMC TrueSight Operations Management into BMC TrueSight IT Data Analytics to perform root-cause analysis. You can cross-launch from both applications and events. For more information, see Integrating with BMC TrueSight Operations Management.

Notification enhancements

The following enhancements are added:

• Out-of-the-box notification templates: The following enhancements are available for sending notification messages during configuration of an alert or report:
  • Use default templates with default messages to send notifications.
  • Create new templates containing custom messages to send notifications.
  • Use macros in the notification message that will automatically be substituted with particular values when the notification is sent. You can choose from a list of macros available with the product.

• New event type: While logging events on BMC ProactiveNet Performance Management, you can log events with the event severity set to WARNING.

  Note

  Beginning with version 10.0.00, BMC ProactiveNet Performance Management is known as BMC TrueSight Infrastructure Management.

• Scheduling options: You can select notification details to the minute level, which means you can set the notifications for a specific time in minutes. For example, you can set a notification to recur every two hours at 15 minutes past the hour by specifying Hours > Every 2 hour(s) at > at 15 minute(s) past the hour in the scheduling options.
• Option to include or exclude duplicate events: While configuring a notification alert, you can choose to include or exclude duplicate events returning from BMC ProactiveNet Performance Management for which you were already notified. The option to include or exclude returning events is controlled by the Exclude duplicate events check box.
• Event route: The Event Route label is renamed to Notification Destination(s) to make it more intuitive.

For more information, see Managing notifications.

Search command enhancements

The following enhancements are added:

• When you run a tabular command (such as stats), the search results are displayed progressively.
  For more information, see Tabular commands.
• The stats and timechart commands support the stddev function. This function helps you obtain the standard deviation for the values of the field specified.
• The stats command supports the limit and sortby parameters. The limit parameter can help you limit the number of results obtained and the sortby parameter can help you sort the results by one of the aggregate functions specified.
• Tabular commands, by default, display results in the chart view. Also, these commands provide simplified comparison options that help you compare the results (summarized as a chart) across different time contexts, such as previous day, previous week, and so on. For more information, see Tabular commands.

Search enhancements

The following enhancements are added for improving the search experience:

• When you perform a search on the Search tab, the results are displayed on the All Data page. For more information, see Search results.
• From the three dots menu of the All Data tab, you can navigate to the Coalesce Data page and the Compare Data page. The Coalesce Data page provides a list of similar search results grouped together based on the data pattern and sorted by count (number of occurrences). The Compare Data page enables you to compare the search results summarized on the timeline chart across different time contexts.
• An internal field, timestamp, is supported for searching. For more information, see Understanding fields and tags.
• The graph that displays the data indexed over the last week has been moved to the Default dashboard page. Unlike earlier versions, this graph displays data for the last 24 hours instead of the last 7 days. For more information, see Understanding the Default dashboard page.
• The search bar is now moved to the center of the Search page.
• You cannot pause and resume a search manually. However, while the search results are still being displayed, you can cancel the search manually. If your search takes too long (more than one minute to be completed), the search is automatically paused and you can choose to continue searching or stop the search. For more information, see Continuing a paused search and stopping a search.
• The following features are discontinued to simplify the user experience and effectively use the Search page area:
  • Quick access items displaying the list of data collectors, workspaces, and notifications on the Search landing page.
  • Colored triangles marking the data collectors associated with the search results appearing under the timeline chart.
  • The Workspaces panel displayed on the right of the Search page.
  • Clicking a word in your search results to add it to the search criteria and perform a new search.

Security enhancements

The product checks against cross-site request forgery (CSRF) attacks and prevents them. For more information, see Security planning.

Stand-alone Collection Agent enhancements

Beginning with version 2.0.00, the following enhancements are added:

• You can install the stand-alone Collection Agent without administrator privileges on Microsoft Windows and without root privileges on Linux. For more information, see Preparing for installing the standalone Collection Agent.
• While installing the stand-alone Collection Agent, you can associate the collection profile names with which data collectors must be created. For more information, see Installing the standalone Collection Agent.

Using a secured connection to access the product console

Beginning with version 2.0.00, you do not need to perform any configurations for enabling security for the Console Server. You can use a secured connection for accessing the Console Server by replacing "http" with "https" in the console URL, and by replacing the port 9797 with 9443. For more information, see Enabling security for third-party certificates.

Viewing coalesced results

Version 2.0.00 introduces the Coalesce Data page, which provides a report summary indicating the pattern in which search results occur for a particular search query. This page helps you analyze your search results better and identify important patterns.

When you perform a search, by default, the search results are displayed on the All Data page. To see the coalesced results, click the three vertical dots (indicating a menu) next to All Data, and select Coalesce Data. The coalesced results are a list of grouped results (or data records) based on the data pattern.

The information available on the Coalesced Data page can help you determine the following information at a glance:

• What are the kinds of data records (or events) available as a result of running a search?
• Which are the noisiest and rarest data records (or events) as a result of running a search?
• How frequently do the noisiest and rarest data records occur?
• Is there a pattern in which the data records (or events) occur?

For more information, see Coalesced results.

Windows event collection enhancements

The following enhancements are added for collecting Windows events: