View metrics
The Metrics page in the UI enables you to view ingested metrics and anomalies of interest. The easiest way to view relevant metrics is to drill down from an incident:
Go to the Incidents page and select an incident.
In the Incident Details pane, click the Metrics drill-down button.
This brings you to the Metrics page. The drilldown automatically filters the metrics and time window for the selected incident.
Metric chart reference
A. Source — Source node for the metric.
B. Managed Object — The fully-qualified name of the managed object that defines the configuration settings for the metric.
C. Metric Name
D. Anomalies — The number of detected anomalies in the current time window.
E. High — The highest data value within the current time window.
F. Raw/Rollup/Boxplot — Set the aggregation view:
Raw: Shows all data points observed during the current time frame. You can quickly see when, and for how long, the metric transitioned between an in-bound and an anomalous state.
Rollup: Highlights the overall means, medians, and sigmas.
Boxplot: Highlights the distribution of the data based on quartiles, from the lowest to the highest data point. Boxplots make it easy to see how the distribution of data points varies from one time bucket to the next.
G. Chart Controls — Buttons to view a combined chart, zoom in/out, pan forward/backward, and change the chart height.
H. Data Point Table — See Metric data point reference below.
Metric data point reference
To view information about a specific data point, rest the cursor over that point in the chart. The table to the right shows the following. See also Customizing Anomaly Detection for Individual Metrics (Advanced).
Note
Moogsoft stores all timestamps in UTC format. The dates and times displayed in the UI are based on your browser's local time.
Field | Description |
|---|---|
Time | The local time when the data point was captured. |
Severity | Severity, if the data point is an anomaly. |
High Threshold | The high threshold for normal performance at the time the data point was captured. |
Low Threshold | The low threshold for normal performance at the time the data point was captured. |
Detector | The anomaly detector in use when the data point was captured. |
Deviations | The number of standard deviations above or below the mean at which the detector determines that a data point is an anomaly. |
Confidence | The level of confidence that the data point is an anomaly, from 0 (low confidence) to 1 (high confidence). A low confidence value might indicate a relatively small sample size. It might also indicate that the data distribution is less normalized and more scattered, with more variations from the statistical average that represents "normal" behavior for that metric. |
Vector | The detector considers anomalies based on whether a data point is
|
Median | The median value in effect when the data point was captured. |
Hold For | The detector setting in effect when the data point was captured. You can configure this setting when you set up the detector. |
Stateful | The detector setting in effect when the data point was captured. You can configure this setting when you set up the detector. |
Window | The detector setting in effect when the data point was captured. You can configure this setting when you set up the detector. |
Searching and filtering metrics
You can do the following types of search:
Free-text search in the Global Search window in the top left.
"Smart look-ahead" filtering in the Incidents, Alerts, and Metrics tables. Place your cursor in the search field above the table. A pull-down menu shows the data fields or operators that are valid for that position in the filter string.
After you validate a filter you can save, edit, reuse, and delete it as needed. You can also copy and paste a filter string into a relevant API request. You can define compound filters such as:
source in ("MCsource01", ["MCsource02") and severity in (Critical, Major, Minor)
Note the following:
It is good practice to use the smart-lookahead features to create your incident, alert, and metric filters.
Incident, alert, and metric filters support different sets of fields. This means that you cannot necessarily use filters across data types. The filter
service in (svc00, svc01)works for incidents and alerts but not for metrics, because incidents and alerts have aservicefield but metrics do not.