Sophie uses 5 different sets of classifications for properties. Classified properties determine the way that Sophie analyzes this property and determines anomalies.
Classifying the properties is a one-time activity. Any property that is extracted can be classified into the following types:
For Meter-type properties, loom calculates the number of times this property is written in each and every log message. Loom issues anomalies about this metric and presents the changes in its value changes as part of the Auto Root Cause Analysis.
Gauge measures a range and not the number of times a property was shown. Therefore, it is ONLY relevant for numeric values. For example, classifying the temperature of a machine as a gauge issues anomalies when the temperature is very high or very low. By classifying a property as a Gauge, Loom assumes that the value of this property is reported in routine times. (i.e. the property is showing up at a constant frequency daily)
Timeless Gauge is very similar to a regular gauge, except that it is regardless of time. This means that the numerical value is not reported in routine times.
The property is not reported as an anomaly by itself but is only a part of the Root Cause Analysis of another anomaly. Any property that can answer the where?, how?, and/or what? of an anomaly should be classified as ARC.
This property is neither calculated nor shown in the ARC.
Here is where you assign classifications:
- Under "Settings" >> "Add and Manage Data" >> "Source Types" identify the source type you wish to work on, and click "Structure" from the options on the right hand side.
- Extracted properties should be listed per example/sample that shows in the Source Type.
- Review the classification of each field and make sure that the classification is matching to the property.
- Please review the following example:
- Make sure that contextual fields / unique identifiers are assigned as ARC. Do not classify such fields as "Meter"!
- Browse through 10 examples to review the classifications on multiple samples..
- Go back to the source types screen and click "Properties". This screen will allow you an overview of all properties in the source type:
- Review the classifications one last time: