- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-15-2017 08:56 AM
Good morning community,
I am hoping someone can point me in the right direction with odd results I am getting with an automated indicator that should be counting all open incidents given the criteria in my indicator source. And it DOES work, however, every day it runs, it overwrites MOST previous days with the results from the last day. It makes it impossible to chart over time, and it is driving me nuts that I am probably missing something easy that is right in front of me.
Indicator Source-
Indicator-
Results-
What am I doing wrong? I want a running total of the open INC inventory so I can chart it, but this gives me a straight line rather than the steady upwards progression we are trying to halt. Where is the bit of logic I am missing?
Thanks!
Solved! Go to Solution.
- Labels:
-
Performance Analytics
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-15-2017 01:19 PM
Woot! Sounds like we made progress!
As for collecting historic data, what you'll need to do is change your filter to account for the date. To do that, instead of saying Date Created between 1/1/2017 and 12/31/2017, change it to Date Created At or after 1/1/2017 00:00:00 [and] Date Created Before Tomorrow.
When you do that, as the historic collection iterates over each date, it will plug in midnight of the collection date in as "Tomorrow".
That should get you the data you need in a historic collection.
[Edit:]
Just to expand on what I typed above because it might look a bit arcane, when you run a historic collection, what PA does is iterate over each date that the collection runs for; for example, the past three months. It will run a collection for May 15, then May 16, then May 17, and so on, up through August 14.
For each date, it will generate a collection period start and collection period end. For May 15, the collection period start will be 2017-05-15 00:00:00, and the collection period end will be 2017-05-15 23:59:59. For July 3, the collection period start will be 2017-07-03 00:00:00, and the collection period end will be 2017-07-03 23:59:59. And so on.
When the collection actually happens, all dates and times are calculated relative to the collection period, not the current date. If you have dates hard-coded in the condition, such as between 2017-01-01 00:00:00 and 2017-12-31 23:59:59, then the collection period will be ignored, and all of your numbers will be the same (the current value).
If, on the other hand, you use a relative date, such as "Today", "Tomorrow", or the like, then the condition will apply to the date/time relative to the collection period. That's why when you use "Date Created At or after 2017-01-01 00:00:00 [and] Date CreatedBefore Tomorrow" as your condition instead of the between condition you were using, what happens is that the collector says, "Query for anything created at or after 2017-01-01 00:00:00 relative to my current collection period", which is 2017-01-01 00:00:00 since that's a literal, static value, "and created at or before Tomorrow relative to my current collection period", which, for July 3 for example, would be before midnight on July 4.
The end result will be the number of records opened at or after 2017-01-01 00:00:00 and before 2017-07-04 00:00:00 (that is, through 2017-07-03 23:59:59). On May 17, the effective range would be anything opened at or after 2017-01-01 00:00:00 and before 2017-05-18 00:00:00 (that is, through 2017-05-17 23:59:59). And so on.
Hope this helps!
--Dennis R
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-15-2017 10:15 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-15-2017 12:07 PM
Thank you Arnoud.
I did check the job settings, and it was set for 90 days. I set to 1, re-ran the collection, and did get a new score for yesterday. I think I am missing your OOB conditions you mention for me to emulate? I did look at the indicator source for incidents.open, and I am not seeing anything that would help- the conditions for it would not even work. I cannot tell if it is stock OOB- most of the system has been tweaked over the years. I had no success locating what the OOB should be.
I suspect you are correct and my historical collection is not working due to something. Was there an image that should have been in your post, or am I grasping at straws .
Thanks,
Jeff
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-15-2017 02:54 PM
Yes It seems the screenshot was missing, I edited the post to add it
For historic collection you must also remove the indicator conditions Active is true and State is not resolved
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-15-2017 12:06 PM
Hey Jeff, at the bottom of your Automated Indicator form, what Jobs is this indicator associated with? Can you post a screenshot of each job form it's associated with? I have a suspicion that this is where the issue might be, if it's associated with a scheduled job that covers more than the interval that the indicator runs.
--Dennis R