User goals and features

You can collect various kinds of machine data generated by a variety of data sources, and subsequently perform in-depth analysis as a part of your troubleshooting, or understanding the data.

For more information about data collection, see the following topics:

• Managing data collectors (outlines information about data collectors used for actually collecting data)
• Managing data patterns (outlines information about patterns used for indexing data used by data collectors)

You can automate your data collection process in the following ways:

• Create collection profiles to use data collector templates for automatic data collector creation. For more information, see Managing collection profiles.
• Create hosts to capture host credentials for use when creating data collectors. For more information, see Managing hosts.
• Create credential profiles to capture system credentials for use when creating data collectors. For more information, see Managing credentials.

• Use the product interface to search and investigate real-time and historical data to troubleshoot problems, perform root-cause analysis, and discover trends and insights in your business operations. For more information, see Search tab.
• Use search commands to interact with your data in various ways (group, filter, broaden, or limit your search) and perform advanced analysis using statistical and reporting search commands. For more information, see Search commands.
• See your search results represented graphically by the timeline and summarization charts. Use these charts to see data trends and discover spikes or anomalies. Click the bars in the timeline chart to drill down into the search results and focus on meaningful data. For more information, see Using the timeline and summarization charts.
• Click fields in your search results to add to your search criteria and perform further analysis of your data. View your search results with different levels of detail and for different time ranges. Use the asterisk (*) as a wildcard character either before or after your search string to substitute for words before or after a substring. For more information, see Searching the data.
• Filter your search results by changing the time context, using fields and tags in the search criteria, or by using search operators and get more accurate results. For more information, see Filtering your search results.
• Add meaning to your data by specifying fields (when creating data patterns) that must be extracted from your data and adding tags (when creating data collectors) to add to your search criteria and enhance your search results. For more information, see Understanding fields and tags.

Create custom dashboards to represent data graphically, and monitor trends in your data to track irregularities or abnormalities.

Use dashboards to represent data such that you can correlate events or seemingly unrelated activities or discover data relationships.

For more information, see Managing dashboards.

Save searches to monitor data for an extended period of time and locate real-time abnormalities or events and then send out alerts via email messages or logging events into supported external systems. You can also attach PDF reports with the related search results and the summarization chart.

Notifications can be sent in real time, depending on the conditions and thresholds specified.

For more information, see Managing notifications.

Integrate with external systems such as BMC ProactiveNet Performance Management and BMC Event Manager to get event data and perform root cause analysis.

You can perform in-depth analysis on events by using the context from these systems, create notifications, and create custom dashboards to monitor these events. You can also log events into the external system for any abnormalities found.

For more information about collecting and monitoring events from the supported external systems, see Integrating.

Content packs are a group of product components such as saved searches, data patterns, and collection profiles.

You can perform the following actions related to content packs:

• Export content packs in a zipped format to share with others.
• Import content packs shared by others or stored earlier, and then use the components imported, in the process of data collection and search.

Content packs are also useful for sharing in multiple-server environments or when you have multiple product instances.

For more information, see Managing content packs.