Overview
Introduction
The « Quick Queries » module allows the easy generation of event graphs and reports. Reports can be generated transparently out of events stored in a cell, or events stored in a separate SQL database.
To run a quick query, you must define a time window (from date to date or using a set interval), and optionally additional conditions that the events must meet to be considered in the report. Once a time window and/or additional conditions have been defined for a given type of quick query, these can be saved for later re-use.
Types of quick queries are described in the table below.
|
Graph type |
Description |
Use cases (examples) |
|
Simple pie/Simple donut |
Displays the distribution of a slot value (in percentage and absolute terms) |
Distribution of events by severity Distribution of events by customer |
|
Ratio pie |
Displays the percentage of events matching a specific condition |
Percentage of events for which an incident was created. Percentage of events with a closing time < 15 minutes |
|
Simple line |
Displays the evolution of the number of events over time |
Evolution over time of the total number of events Evolution over time of the number of critical events for customer X |
|
Composite line |
Displays the evolution of the number of events over time, one line per value of a given slot |
Evolution of the number of events over time, one line per customer Evolution of the number of events over time, one line per severity |
|
Average line |
Displays the evolution over time of a numeric value (duration, repeat_count, custom slot, or difference between two numeric slots e.g. dates) |
Evolution of the duration of critical alerts over time |
|
Composite average line |
Displays the evolution over time of a numeric value , one line per value of a given slot |
Evolution of the assignment time for critical alerts, one line per customer |
|
Simple bar chart |
Displays the number of alerts, one bar per value of a given slot (“Top N” filter available) |
Top 10 of hosts sending the largest number of critical alerts Top 5 of applications sending the largest number of PATROL events. |
|
Composite bar chart |
Displays the number of alerts, one bar per value of a given slot, grouping by another slot (“Top N” filter available) |
Top 10 of hosts sending the largest number of critical alerts, grouping by severity |
|
Average values bar chart |
Displays the average of a numeric value, one bar per value of a given slot |
Top 10 of the « duration » time, by customer |
|
Ratio bar chart |
For each value of a given field, displays the percentage of events matching a given condition |
By application, percentage of events with a duration < 15 minutes |
|
Ratio diagram |
Displays the evolution over time of a number of alerts and the number of those alerts matching a condition |
Evolution of the total of alerts vs the number of non enriched alerts |
|
Heatmap |
Distribution of alerts along two axes, by severity, number of alerts, or both |
Distribution of worst severity by application and technological layer |
|
Table report |
Event list |
Table of all CRITICAL events that have arrived since the beginning of the week |
|
Simple gauge |
A counter of the number of events matching the query |
Number of open CRITICAL events over the last 60 minutes |
|
Ratio gauge |
A counter (or percentage) of the number of events matching a subcondition between a broader query. |
Percentage of non-assigned CRITICAL events over the last 12 hours. |
|
Weather chart |
A table showing indicators (typically sun/cloud/rain/offline) of the number of events for a particular slot |
Realtime status of applications. |
|
Summed values bar chart |
A bar chart showing the total sum of numeric values, one bar per value of a given slot |
Cumulated duration of events per application |
|
Summed values line chart |
A line chart showing thee evolution in time of the total sum of numeric values |
Evolution over time of the duration of events |
Timestamps included in quick queries reports (e.g. in the table view) are shown in the time zone chosen for the web browser.
QuickQueries works against all slots defined at “EVENT” class (or whatever other class set in the “TopLevelClass” QuickQueries parameter) level.
The time window is for the “mc_arrival_time” value of the events.
How it works
Cell based queries
“Cell-based” queries are reports where the data is obtained from the target cell itself.
The application uses “mquery” commands in order to retrieve the information and no additional infrastructure is required.
SQL based queries
SQL based queries are built using data queried from an external database. In this mode, an Import Script (provided) must periodically run to ensure the event data are stored in the SQL database.
The database instance is not provided as part of the solution.