Investigating ML-based situations

Situation summary based on natural language processing (NLP)

Because every situation is unique, to help service operators and SREs understand the context and cause behind the event correlation, BMC Helix AIOps provides a human-readable text summary based on the natural language processing (NLP) analysis. If the summary is not enabled for your tenant, contact BMC Support.

To view and investigate a situation

1. On the BMC Helix AIOps console, click Situations.
   By default, you can see All Situations in the hierarchical view. You can change it to a list or tile view.
2. Click a situation to view the following details:
   • Situation name, severity, incident ID (if available), status, and last modification date.
     For ML-based situations, the impacted service name is also displayed with a link.
     • (Optional) Click the link to open the service details page.
     • (Optional) Click the Incident ID link to view the incident in BMC Helix IT Service Management – SmartIT.
     • Action menu to perform actions on situations. 
   • Situation highlight to show the number of events from the top three impacted hosts.
   • 
     
     
3. (Optional) Expand the Similar Situations section to analyze the pattern and trend of similar situations associated with the same service node.
   This section is displayed only if at least two occurrences of similar situations are identified within a 24 hours window. This section is not displayed for a primary situation.
   1. Click the Aggregated View to view the number of occurrences against the day of the week. The day of the week is represented on the Y-axis and the hourly time slot for 24 hours is represented on the X-axis. This view is seen only if there are situations available for more than one week. The situations are grouped by the day of the week from Sunday to Saturday.
   2. Click the Detailed View to view the number of occurrences against day and date for the last 30 days. The day and date is represented on the Y-axis and the hourly time slot for 24 hours is represented on the X-axis. This view is seen even if the data is available for a single day. This view captures data between the first occurrence date and the most recent occurrence date for the last 30 days. 
   3. Click Show More to view additional situation details such as time of occurrence, number of related events, type, severity, priority, status, and incident ID. Clicking the Incident ID link opens the incident in BMC Helix IT Service Management – SmartIT. 

   4. (Optional) Click the action menu to perform event actions for a situation.
      

      Important

      All events except the alarm type events can be closed. You can close a situation even if the incident created for the situation is not closed.

      
      
      
      
      

4. (Optional) In the Situation events section, click the column selector to customize the columns that appear here and clear the columns that you do not want to appear.
   Only selected columns are displayed. You can also drag and drop the columns to rearrange them based on your requirement. 

5. (Optional) Change the View Type to either Flat or Hierarchical.
   The flat view type is selected by default, where the events are listed in a sequence. A hierarchical view groups events within events based on event signatures to give a better organized presentation of events as shown in the following image:
   

   If the Intelligent Automations feature is enabled:

   • You will see the Automations column with automations that match the displayed event. To run automations, see Remediating-events-for-services-and-situations. 
   • (Optional) You can also request that automations be created or if you have permission, create automations for events yourself.

   
   
   

6. (Optional) Expand the Situation events section and do the following actions:

   • Select List view to view additional event details and perform event operations. Do the following actions:
     

     • Use the column selector to customize the columns and make it appear or disappear from the view.
       Only selected columns are displayed. You can also drag and drop the columns to rearrange them based on your requirement. 
     • Change the View Type to either Flat or Hierarchical.
       The flat view type is selected by default, where the events are listed in a sequence. A hierarchical view groups events within events based on event signatures to give a better organized presentation of events.

     
     

     1. Click an event message to view the Event Details pane with the following details:
        
        • Event name, event score, severity, priority, status, and the More Details button to open the event details page in BMC Helix Operations Management. 
        • Event assignee details.
        • Date when the event first occurred or was last modified.

        • Event summary showing the Class, Incident ID, Object Class, Object, and Host. Clicking the Incident ID link opens the incident in BMC Helix IT Service Management – SmartIT. 
          For more information about Classes and Objects, see EVENT base event class..

        • Logs and notes history: All logs and notes for an event are displayed.
          • Enter a note in the text box and click Add Note to add any additional notes related to the event. 
            Any note added for the event is reflected for the event in BMC Helix Operations Management.
        • Performance View tab: If the slot value for the event class is Alarm, the tab displays the time-series data collected from key the attributes of the causal events of ML-based situations.
          
     2. Click the action menu to perform event actions.
        
7. (Optional) Expand the Related Situations section.
   By default, this section remains expanded for a primary situation.
   
   1. Identify the root-cause situation and analyze the attributes such as time of occurrence, number of similar situations, number of related events, type, severity, priority, status, and incident ID. Clicking the Incident ID link opens the incident in BMC Helix IT Service Management – SmartIT. 
      
      • The (Primary Situation) icon under the Type column represents a group of stabilized or saturated ML-based situations. 
      • The (Root-Cause) icon before the Situation name represents the root-cause situation among the list of all correlated situations.
   2. (Optional) Click the action menu to perform actions for a situation.

Situation or event actions

 The event actions are available based on user role. The following table describes the actions you can perform on situations or events. For more information about the impact of actions on an event, see Performing event operations in the BMC Helix Operations Management online documentation.