User goals and  features

Collect and index data

You can collect various kinds of machine data generated by a variety of data sources, and subsequently perform in-depth analysis as a part of your troubleshooting, or understanding the data.

For more information about data collection, see the following topics:

• Managing-data-collectors (outlines information about data collectors used for actually collecting data)
• Managing-data-patterns (outlines information about patterns used for indexing data used by data collectors)

You can automate your data collection process in the following ways:

• Create collection profiles to use data collector templates for automatic data collector creation. For more information, see Managing-collection-profiles.
• Create hosts to capture host credentials for use when creating data collectors. For more information, see Managing-hosts.
• Create credential profiles to capture system credentials for use when creating data collectors. For more information, see Managing-credentials.

Search and investigate

• Use the product interface to search and investigate real-time and historical data to troubleshoot problems, perform root-cause analysis, and discover trends and insights in your business operations. For more information, see Search-tab.
• Use search commands to interact with your data in various ways (group, filter, broaden, or limit your search) and perform advanced analysis using statistical and reporting search commands. For more information, see Search-commands.
• See your search results represented graphically by the timeline and summarization charts. Use these charts to see data trends and discover spikes or anomalies. Click the bars in the timeline chart to drill down into the search results and focus on meaningful data. For more information, see Using-the-Timeline-and-Summarization-charts.
• Click fields or raw data in your search results to add to your search criteria and perform further analysis of your data. Pin important search results that you want to investigate later by clicking the star icon next to the search result. View your search results with different levels of detail and for different time ranges. Use the asterisk (*) as a wildcard character either before or after your search string to substitute for words before or after a substring. For more information, see Searching-the-data.
• Add meaning to your data by specifying fields (when creating data patterns) that must be extracted from your data and adding tags (when creating data collectors) to add to your search criteria and enhance your search results. For more information, see Understanding-fields-and-tags.

Create data charts

Create custom views to represent data graphically, and monitor trends in your data to track irregularities or abnormalities.

Use views to represent data such that you can correlate events or seemingly unrelated activities or discover data relationships.

For more information, see Managing-views.

Capture and share insights

The workspace keeps a record of all search queries that you execute and allows you to perform the following functions:

• Capture insights discovered in the course of your troubleshooting.
• Create multiple workspaces for every task and perform functions such as marking search queries as favorites, adding notes to the workspace, and so on.
• Share the steps you used for troubleshooting a problem with others and turn those steps into best practices.
• Run search queries for the original or relative time context from the workspace.

For more information about using the workspace, see Managing-workspaces.

Generate notifications and log events

Save searches to monitor data for an extended period of time and locate real-time abnormalities or events and then send out alerts via email messages or logging events into supported external systems. You can also attach PDF reports with the related search results and the summarization chart.

Notifications can be sent in real time, depending on the conditions and thresholds specified.

For more information, see Managing-notifications.

Integrate with other products and analyze context-aware data

Integrate with external systems such as BMC ProactiveNet Performance Management and BMC Event Manager to get event data and perform root cause analysis.

You can perform in-depth analysis on events by using the context from these systems, create notifications, and create custom views to monitor these events. You can also log events into the external system for any abnormalities found.

For more information about collecting and monitoring events from the supported external systems, see Integrating.

Import and export content packs

Content packs are a group of product artifacts such as saved searches, data patterns, and collection profiles.

You can perform the following actions related to content packs:

• Export content packs in a zipped format to share with others.
• Import content packs shared by others or stored earlier, and then use the artifacts imported, in the process of data collection and search.

Content packs are also useful for sharing in multiple-server environments or when you have multiple product instances.

For more information, see Managing-content-packs.