Query Stored Events
Transaction Trace session results are automatically stored in the Transaction Event Database. Transaction events include Transaction Traces and errors, including stalls (if you have installed Introscope Error Detector.) The Transaction Event Database contains Transaction Traces that were automatically sampled by Introscope . The database also contains the results of Transaction Traces sessions you run yourself.
apmsaas
Transaction Trace session results are automatically stored in the Transaction Event Database. Transaction events include Transaction Traces and errors, including stalls (if you have installed Introscope Error Detector.) The Transaction Event Database contains Transaction Traces that were automatically sampled by Introscope . The database also contains the results of Transaction Traces sessions you run yourself.
2
2
The Transaction Event database supports these types of queries:
- historical events (basic) -- see Querying historical events
- similar events (to selection)
- correlated events (to selection)Note:Be sure that you run some Transaction Trace sessions before you use the historical query, so that there is data to query.
Query Syntax
The sections below describe how to use the Historical Query facility to query stored errors. The query facility:
- Is case-insensitive --for query strings or values for query options.
- Supports the asterisk (*) wildcard character --Enter a fragment of a search term followed by the asterisk. (You may not start a search term with the asterisk character). For instance, to look for errors associated with a component whose name includes the string Shopping, use the query string Shopping*.
- Supports Boolean operators --Search terms can use Boolean logic, such as "AND", "OR", "NOT". and "()" groupings.
- Supports exclusion conditions --Use "+JDBC -CICS" to look for transactions with JDBC but not CICS.
- Supports query options --Use the options described in Query options and syntax to limit your query error events that occurred in a particular timeframe, or are associated with particular users, or elements of the hosting environment (as identified by domain, agent, host, or process).
Query Historical Events
You can query historical transaction events.
Follow these steps:
- Select Workstation > Query Historical Events.The Historical Query Viewer opens.The Query field will display, in a drop-down, up to twelve previous searches from this session, or previous sessions by the same Workstation user. This enables you to select one of your saved searches instead of retyping it.Tip:By default, the field remembers up to twelve searches; you can designate a different number of searches for the field to remember by editing the introscope.workstation.historical.query.history.limit property inIntroscopeWorkstation.properties.
- In the Query field, enter a combination of:
- the query optiontype:to include all transaction events that match the specified type.
- a query string -- to search for errors that contain or match a string. If you don't enter a query string, all errors events are returned.
- query options -- to limit your search based on event parameters, as defined in Query options and syntax.
Tip:As you begin typing in the Query field, the searches displayed in the drop-down will be limited to those that match what you have typed. - Use the Time Range option to filter your query based on a time range, if appropriate -- see Viewing historical data for an explanation of how to use the Time Range option.If you don't select a time range, the query uses the default of All and does not apply a filter.
- Click Go.Transactions that match the query are displayed in the Historical Query window -- the format is similar to the Transaction Trace Viewer. For more information see Using the Transaction Trace Viewer.Note:Only 500 events can be viewed. If more than 500 events match the query, the oldest 500 are shown.
Query Options and Syntax
Queries use Lucene regular expression syntax to locate and substitute text strings.
Note:
For information about Lucene syntax, see the Lucene website (lucene.apache.org) and search for "query syntax." Field | Description | Example |
agent | Limits the search to events reported by a particular agent. | agent:ControlledRangeAgent |
domain | Limits search to events related to component(s) in a given domain. | domain:AcmeWest |
fullAgent | Limits search to events reported by specific agent(s), as specified by its full path:
domain|process|host|agent. | fullAgent:AcmeWest| Custom Metric Host|
ControlledRange
Agent |
host | Limits search to events that occurred on a particular host. | host:Wmiddle01 |
process | Limits search to errors related to component(s) in a given application. | process:Custom Metric Host |
root | Limits search to events associated with specific component(s), as specified by metric path. | root:servlets|accountServlet |
type | Specifies the type of event to include in query results.
errorsnapshot -- Limits search to error events.
normal -- Returns transaction events captured in user-initiated Transaction Traces.
sampled -- Returns transaction events that were captured as a result of Introscope's default transaction sampling. | type:errorsnapshot
type:normal
type:sampled |
url | Limits search to events associated with the specified transaction URL path prefix.
The path prefix is the portion of the URL that follows the hostname. In the following URL:
http://burger1.com/bWar/burgerServlet?
ViewItem&category=11776&item=55562630&rd=1
... the path prefix is:
/bWar/burgerServlet | url:/bWar/burgerServlet |
urlParams | Limits search to events associated with the specified transaction URL parameters.
URL parameters follow a question mark (?) in the URL. In this URL:
http://ubuy.com/ws/shoppingServlet?
category=734&item=3772&tc=photo
the URL parameter portion is:
?category=734&item=3772&tc=photo
Note: urlParams cannot start with a wildcard character. | urlParams:category=734* |
user | Limits search to events for transactions associated with the specified Username. | user:jdoe |
duration | Limits search by event duration (default milliseconds). | |
componentsNotShown | Limits search to events where a given component is not shown | |
durationencoded | No definition provided | |
time | Limits search to events before or after a specified time. | time:[yyyyMMddHH] where y=year, M=month, d=date, and H=hour of day |
traceID | Limits search to events with a specified trace ID. | traceID:1340419311156\:3957
Note : A backslash (\) character is required before the second colon (:). |
If the following special characters are part of your query, Lucene syntax allows you to escape them with a backslash (\) character:
+ - && || ! ( ) { } [ ] ^ " ~ * ? : \
For example, to search for (1+1):2, use the query:
\(1\+1\)\:2
Note:
The * (asterisk) and ? (question mark) characters are not supported at the beginning of a query.Query for Similar Events
In Introscope you can query for events that are similar to a selected event. For example, similar events might be events that all contain the same components (Servlet > EJB > SQL) with varying response times. Introscope considers events similar if 60% of the strings within them (component names, SQL tables names, and so forth) overlap.
Note:
Even if a transaction type event is selected, both transactions and errors might be returned in the results (errors are only be returned if ErrorDetector is installed). Follow these steps:
- With a window of query results open, select a table row.
- Select Trace > Similar Events.
Introscope lists similar events in the Historical Query window.
In Introscope you can query for events that are correlated -- those that are part of the same larger transaction. For example, a browser response time event is correlated with a servlet transaction event.
Note:
Even if a transaction type event is selected, both transactions and errors might be returned in the results. Follow these steps:
- With a window of query results open, select a table row.
- Select Trace > Correlated Events.
Introscope lists correlated events in the Historical Query window.