Working with Insights

Insights are a collection of anomalies which, when gathered together, tell the story of your data. During investigations, Insights can be built up as a way to collate evidence of a system issue. Once built, they can be shared with colleagues for knowledge transfer and problem resolution.

Insights can be created automatically by an Insight Monitor or manually using the Clipboard.

Information about Insights can be viewed in the following dashboards:

  • Home - use this to view the rate and severity of Insights that are being created, typically set to show the last 24 hours
  • Insight List - use this to see a summary list of Insights over a selected time range for a selected Monitor
  • Insight View - click on an Insight from the Insight List to view its detailed timeline

Note: You will require the prelert_user role in order to create, edit, merge and delete Insights.

Creating Insights using the Clipboard

This section describes how to manually create a user Insight using the Clipboard. For automatic Insight creation, read details on Insight Monitor Configuration.

From many of the anomaly result dashboards, there are action menu items in the anomaly record panels which allow you to Add to Clipboard. This action will copy the selected anomaly record to the Clipboard.

Add to Clipboard

To access the Clipboard, select Investigate > Clipboard from the main menu.

Here you can view anomaly details by expanding each row, or remove unnecessary anomalies. Once the Clipboard contains the collection of anomalies of interest, then select Save as new Insight. This will create a new user Insight.

Clipboard

Important

The Clipboard information is temporarily saved in your local browser. Whilst it is often retained between browser sessions, it should not be relied upon for permanent storage. If you have Clipboard information that you wish to retain, please ensure that you create an Insight.

Editing Insight details

The Insight description and score can be edited from the Insight View dashboard. Click on the edit icon to display the Edit Insight Details popup window.

Edit Insight description

Editing Insight status

Insight status can be updated from the Insight View by selecting the status drop down menu item.

Edit Insight status

Insight status can also be updated (to any value except new) from the Insight List. This can be done for a single Insight using the Action menu items, or this can be done by selecting multiple Insights and clicking on Update status.

Edit Insight status

The Insight status can be set to the following:

Status Description
new Newly created Insights will always have a status of new. A new Insight may be amended by an Insight monitor, that may add further relevant anomalies or update its score.
open Once an Insight is being investigated, the end-user can set its status to open. Insight monitors cannot update an open Insight.
closed relevant Once an Insight has been investigated and found to be interesting or actionable, the end-user can set its status to closed relevant.
closed not relevant Once an Insight has been investigated and found not to be useful, its status can bet set to closed not relevant. If many Insights have this status, then consider changing the base anomaly searches or Insight monitor configuration.

Adding anomalies to an Insight

Anomalies can be imported from the Clipboard and added to an exisiting Insight. In the Insight View dashboard, click on Import Clipboard. You will be given the option to pick and choose from the anomalies that are in the Clipboard.

Import Clipboard

Removing anomalies from an Insight

In some circumstances, you may wish to remove anomalies from an Insight. This may be because they are not considered relevant to the incident. By removing non-related anomalies, the Insight story can become clearer to other users.

To remove an anomaly, expand the Insight Storyline time box to display the individual anomaly records. Select the drop down action menu next to each anomaly and select Remove anomaly from Insight.

Remove anomaly from Insight

Merging Insights

Use the Investigate > Insight List dashboard to select and merge Insights.

Merge Insights

A new Insight will be created containing all the anomalies from the selected originating Insights.

Merge Insights popup

Enter an Insight description to provide a descriptive name for the insight.

Select the function (from avg, min or max) that will be used to calculate the merged Insight score, based on the originating Insight scores.

If selected, the originating Insights will be given a status of closed merged.

The new merged Insight will be given a status of new.

If the originating Insights were created by different Insight Monitors then the new Insight will be regarded as user created, otherwise the Insight Monitor name is kept.

Deleting Insights

Use the Investigate > Insight List dashboard to select and delete Insights.

Please note that once an Insight has been deleted, it cannot be recovered. The underlying anomalies will not be deleted and will continue to be available.

See also