Event Compress
Event Compress combines repeated similar events into the same log entry, reducing clutter in the Logs view.
Field | Option (if any) | Explanation |
---|---|---|
Correlated Situations | Situations you want to compress. | |
Time Window | All matches to the Situations selected are combined to a common log entry when they are triggered within the defined time from each other. | |
Log Fields Enabled | Select | Events triggered by the selected Situations are regarded as the same when the values those entries have in the Log Fields you place in Lognames are identical. |
Ignore | Events triggered by the selected Situations are regarded as the same, except when the values those entries have in the Log Fields you place in Lognames are identical. | |
Lognames | The selected log fields are used by the matching option you selected in the previous step. | |
Location | Very Early | The execution order of the Compress operation in relation to other operations. Compress operations that share the Location are executed in parallel; each compress operation receives the same events as the other compress operations in the same Location. “Very Early” and “Early” locations can affect the operation of other Correlations. |
Early | ||
Late | ||
Very Late | ||
Compress Filter | Filters in data for the compression. |