Review properties extracted from a source type in Health Log Analytics

Inspect the properties that were extracted from all the source types in a source type structure in a single table to identify any setup issues.

始める前に

Role required: evt_mgmt_admin

このタスクについて

The Source Type Properties Stats table provides a comprehensive overview of the properties that were extracted from the source types. By reviewing the statistical distribution of their values, you can assess the classification of these properties and adjust your settings if needed.

The procedure in this section explains how to access the Source Type Properties Stats table via the Source Type Structure. From a source type record, you can navigate to the Source Type Structure by selecting the Go to Source Type Structure related link.

手順

1. Navigate to All > Health Log Analytics > Source Type Structures.
2. Open a source type structure record.
3. Open the Properties Statistics related links tab.

   

   The Source Type Properties Stats table shows the properties of all the source types that are part of this source type structure.

   表 : 1. Source Type Properties Stats

   Column	Description
   Source Type Property	The property extracted from the source type.
   Classification	The classification of the property. The available types are: METER, GAUGE, ARC, and INVALID. 注: A property classified as INVALID (the default classification) isn't tracked for anomaly detection or shown in the Meaningful Properties analysis.
   Source Type	The source type from which the property was extracted.
   Log Source	The list of Log Sources in which this property appeared.
   Domain	The domain to which the log source belongs.
   Total Unique Value Count	Only for properties classified as METER: The total number of distinct values contained in it. This field is inactive when the property is classified as ARC or GAUGE. 注: The Total Unique Value Count is updated once a day. Records older than 24 hours are deleted automatically.
   Sample Values	Only for properties classified as METER: Sample unique values tracked by the system. Default is 30 samples. This field is inactive when the property is classified as ARC or GAUGE.

4. Review the properties and identify possible classification issues.
5. オプション: View statistics for individual source type properties classified as ARC_ONLY or GAUGE.
   1. Open a source type property classified as ARC_ONLY or GAUGE from the Properties Statistics related links tab.
   2. On the Source Type Property form, select Source Type Properties Stats.
   The following information displays in a pop-up:

   • For an ARC property: The percentage distribution of terms, based on the processed logs. For example, the percentage of Bad Request vs. Success.
   • For a GAUGE property: The average, minimum, and standard deviation from the expected numerical value.
6. オプション: Change classification settings on the Key/Value Mapping tab.
   For more information, see Refine the source type structure in Health Log Analytics.