Investigating ML-based situations

Situation summary based on natural language processing (NLP)

Because every situation is unique, to help service operators and SREs understand the context and cause behind the event correlation, BMC Helix AIOps provides a human-readable text summary based on the natural language processing (NLP) analysis. If the summary is not enabled for your tenant, contact BMC Support.

To view and investigate a situation

1. On the BMC Helix AIOps console, click Situations.
   By default, you can see All Situations in the hierarchical view. You can change it to a list or tile view.

1. Click a situation to view the following details:
   • Situation name, severity, incident ID (if available), status, and last modification date.
     For ML-based situations, the impacted service name is also displayed with a link.
     • (Optional) Click the link to open the service details page.

1. • • (Optional) Click the Incident ID link to view the incident in BMC Helix IT Service Management – SmartIT. 
   • Action menu to perform actions on situations. 
   • Situation highlight to show the number of events from the top three impacted hosts.
   • CI topology map.
     You can identify the CIs with maximum impact probability due to the situation. 
   • Events associated to the situation.
     In the Situation events section you can view the event messages, impacted host, occurrence time, severity, priority, status, and incident ID. This section is not displayed for a master situation. 
   • Clicking the Incident ID link opens the incident in BMC Helix IT Service Management – SmartIT. 
   • Related situations contributing to the problem with the number of related situations.
     You can expand the Related Situations section to view the list of related situations. By default, this section remains expanded for a master situation.

   • Similar situations that occurred in the past with the number of occurrences. 
     The Similar Situations section is displayed if at least two occurrences of similar situations are identified within a 24 hours window. You can expand the section to analyze the list of all historical occurrences of the situation. This section is not displayed for a master situation. 

     
     
     

2. (Optional) In the Situation events section, click the column selector to customize the columns that appear here and clear the columns that you do not want to appear.
   Only selected columns are displayed. You can also drag and drop the columns to rearrange them based on your requirement. 
   

3. (Optional) Change the View Type to either Flat or Hierarchical.
   The flat view type is selected by default, where the events are listed in a sequence. A hierarchical view groups events within events based on event signatures to give a better organized presentation of events as shown in the following image:

   

   Tip

   If the Intelligent Automations feature is enabled:

   • You will see the Automations column with automations that match the displayed event. To run automations, see Remediating-events-for-services-and-situations. 
   • (Optional) You can also request that automations be created or if you have permission, create automations for events yourself.
4. Click any event message to view the following event details: 
   • Event name, event score, severity, priority, status, and the More Details button to open the event details page in BMC Helix Operations Management. 
   • Event assignee details.
   • Date when the event first occurred or was last modified.

   • Event summary showing the Class, Incident ID, Object Class, Object, and Host.
     For more information about Classes and Objects, see EVENT base event class..

   • Logs and notes history: All logs and notes for an event are displayed.
     • Enter a note in the text box and click Add Note to add any additional notes related to the event. 
       Any note added for the event is reflected for the event in BMC Helix Operations Management.
   • Performance View tab: If the slot value for the event class is Alarm, the tab displays the time-series data collected from key the attributes of the causal events of ML-based situations.
     
     
     
5. Click the action menu to perform event actions.
   
   
   
6. (Optional) Expand the Related Situations section.
   By default, this section remains expanded for a master situation.
   
   1. Identify the root-cause situation and analyze the attributes such as time of occurrence, number of similar situations, number of related events, type, severity, priority, status, and incident ID.
      
      • The (Master Situation) icon is displayed in one of the following ways:
        • If you are investigating the master situation from the Situations > All Situations page, the related situations are displayed in a list view.
           
        • If you are investigating one of the child situations within the grouped master situation, the related situations are displayed in a hierarchical view with the master situation icon in the Type column and the (Root-Cause) icon before the root cause Situation name.
          

1. 1. (Optional) Click the action menu to perform actions for a situation.
   2. Collapse the Related Situations section.
      
      
2. (Optional) Expand the Similar Situations section.
   This section is displayed only if at least two occurrences of similar situations are identified within a 24 hours window. This section is not displayed for a master situation.
   1. Analyze the pattern and trend of similar situations associated with the same service node, such as time of occurrence, number of related events, type, severity, priority, status, and incident ID.

   2. (Optional) Click the action menu to perform event actions for a situation.
      

      Important

      All events except the alarm type events can be closed. You can close a situation even if the incident created for the situation is not closed.

   3. Collapse the Similar Situations section.
      

Situation or event actions

 The event actions are available based on user role. The following table describes the actions you can perform on situations or events. For more information about the impact of actions on an event, see Performing event operations in the BMC Helix Operations Management online documentation.