Searching for Metrics

In this video you will learn how to search for metrics. These search functionalities apply to all sections of our platform, including alerts, anomalies, dashboards and the metrics section.

How Search Works 
Simple and Advance Metrics Search Mode
To Use Simple Search Metric
To Use Advance Search Metrics 
Search by Origin 
Property-based Search 
Raw Search 

HOW SEARCH WORKS

      • The user builds a search expression by combining multiple tokens, each of which may be in property-based or raw search format.
      • As  the user starts typing the filter in the expression node, the search engine auto-completes the expression with matching keys and corresponding values. Several options are automatically presented for keys and values.
      • If matching properties are not found for a token, the engine automatically adds the ‘search:’ prefix and builds a raw search token.
      • If the user accepts the token by pressing the ENTER key, the search engine also lists relevant property values for selection.
      • An example of a completed search filter might look like “search:1234, host:web01, region:us…”
      • For metrics in format 1.0, the engine automatically adds the position property (pos1=value1) to the token search filter, for example, “pos1:staging pos4:us search:feed”.
      • Property-based and raw, can be combined in any search for metrics.
      • Autocomplete only shows the first 100 property names or values. If you do not see the properties or values that you need, first narrow the metrics using another token to form an expression subset.
      • Boolean operators are only valid within a property value or raw search and not between properties. See the examples below. 

SIMPLE AND ADVANCED METRICS SEARCH MODE

Use:
     Simple search to search a top down. 
     Advanced search to search bottom up and the advance search features. 

TO USE SIMPLE SEARCH 

      1. On the main Navigation panel, click Metrics to display the Find Metrics window.
        Note: Check that Simple Search Mode is displayed.
        SimpleSearchMockUp.png
      2. Select a function from the Aggregation drop-down menu.
      3. In the Of field select 'what' you would like to search. Either click the field to to display a drop-down menu or start typing to auto-complete the selection.  
      4. Select Filter by and Group By values. Either click the field to to display a drop-down menu or start typing to auto-complete the selection.
      5. Repeat steps 3 and 4 to add multiple OfFilter by and Group by values to the metric.
      6. To exclude Composite Metricsclick the toggle button. The default is for simple search to exclude Composite metrics.
        Note: We recommend to exclude composite metrics because composite metrics cannot contain other composite metrics, therefore cannot be saved either as alerts or as new composites.
      7. Select a Sort order from the drop-down menu [alphanumeric/ highestAverage/ highestCurrent/ highestMax/ lowest Average/ lowestCurrent/ lowestMin/mostDeviant].

 TO USE ADVANCED METRICS SEARCH 

1. On the main Navigation panel, click Metrics to display the Find Metrics window.

2. Click the Switch to Advance button, to display an expression tree.
Note: Check that Advance Search Mode is displayed.
Advance_Search_mode.png

3. Select a Sort order from the drop-down menu [alphanumeric/ highestAverage/ highestCurrent/ highestMax/ lowest Average/ lowestCurrent/ lowestMin/mostDeviant].

The sort order is for preview purposes only, and is computed over the time range specified, except when saving to the Dashboard.

4. Select the number of metrics to be shown in the graph. Up to 50 metrics can be displayed in a graph. If there are more than 50 metrics returned in an expression, clicking on the expression shows the full list in the legend below the chart.

5. To include Composites, deselect the Exclude Metrics check box. By default Composite Metrics are excluded from Advanced Search metrics.
Note: We recommend excluding composites as they cannot contain other composites, therefore cannot be saved either as alerts or new composites.

SEARCH BY ORIGIN

Metrics originating from Data Streams, Alerts and Composite Metrics can be included in metric expressions. To search for metrics by their origin:

      1. Click in the expression node box.
      2. Enter @, to display the Origins drop-down menu.
      3. Select an Origin.
        Origins_options_menuXX_.png
      4. To continue refining the metric expression, select properties or property value pairs.

        Note: To view the originating stream summary/edit alerts window/ view composite window of a specific metric, in the metrics legend click @[stream/alert/composite] of the metric for which you want to see the details.
        View_origin.png

PROPERTY-BASED SEARCH

A property-bases search looks at metrics that consist of specific combinations of key and value. The search value can be built out of composite expressions or partial values.

      • Supports:
        • Wildcards (*)
        • Boolean operators – AND, OR, NOT or minus sign (-)
        • Search format: property_key:value.

To perform property-based search:

      1. Click in the expression node box. A drop-down list of properties and property-value pairs (All values) opens.
      2. In the list, select a property and then a value, such as All(*), a specific value, or a logical expression; or select a property-value pair (token):
        image67.png

        Property-value pairs appear in the All Values section:
        image68.png

         Selecting from the list completes the entry.

       For example: “property1:(US AND UK) property 2:(US*)”

RAW SEARCH

A raw search is a free-form search that looks at metrics that contain the typed characters anywhere in either the property name or the value.

      • Supports:
        • Wildcards (*)
        • Regular Expressions
        • Boolean operators – AND, OR, NOT or minus sign (-)

To perform a raw search

      1.  In the expression node box, start typing the property key or value. The drop-down list shows all properties and values which contain the typed characters:
        image69.png
      2. If you choose a token (property-value pair) from the list, it is entered in the expression node as-is.
      3. If you choose just a property from the list, it is entered in the expression node followed by a colon (:) indicating that a value for the property is expected next.
      4. If you press ENTER, the search string is entered in the expression node preceded by ‘search :’, for example: ‘search : ar”.

Examples  
“NOT (b* OR c*)” becomes “search: NOT (b* OR c*)” after pressing ENTER.
“search:(US AND UK), search:(US*), search:\a{3}b{3}\” 

An example of a metric expression containing both types of searches is:
image70.png

Note: The number shown in the search expression box indicates the number of metrics matching the search.

Was this article helpful?
0 out of 0 found this helpful
-->