Event Compress
Event Compress combines repeated similar events into the same log entry, reducing clutter in the Logs view.
| Field | Option (if any) | Explanation |
|---|---|---|
| Correlated Situations | Situations you want to compress. | |
| Time Window | All matches to the Situations selected are combined to a common log entry when they are triggered within the defined time from each other. | |
| Log Fields Enabled | Select | Events triggered by the selected Situations are regarded as the same when the values those entries have in the Log Fields you place in Lognames are identical. |
| Ignore | Events triggered by the selected Situations are regarded as the same, except when the values those entries have in the Log Fields you place in Lognames are identical. | |
| Lognames | The selected log fields are used by the matching option you selected in the previous step. | |
| Location | Very Early | The execution order of the Compress operation in relation to other operations. Compress operations that share the Location are executed in parallel; each compress operation receives the same events as the other compress operations in the same Location. “Very Early” and “Early” locations can affect the operation of other Correlations. |
| Early | ||
| Late | ||
| Very Late | ||
| Compress Filter | Filters in data for the compression. |