You can hover over any bar or line in your graph to see the number of matching events that were produced by each log. You can then click any log in the chart, to view the log's events in the log viewer under the XpoLog tab. There, you can see the same information that is displayed as free text in the search result events, in column format. measurement point in the graph to view a table with the number of problems that were found under Folders and Logs, Applications, or Servers (depending on the chosen View Type). From this table, you can drill down on a specific Folder or Log, Application log, or Server log in that timeslot. You can keep drilling down until the actual problems are displayed in the table. At this point, the drilldown feature changes into an XpoSearch feature; you can run XpoSearch to search for the problem in all events in the log for the drilled down timeslot, by clicking the problem directly in the table.
For example, initiating Analytics for Applications results in a problems graph for all entities under Applications. Hovering over a measurement point in the resulting problems graph displays a table with the distribution of problems for Windows Event Logs, App1, App2, and App3. Drilling down on Windows Event Logs displays a graph of the distribution of the Security, System, and Application Logs over the timezone of the previous measurement point. Hovering over a measurement point displays a table of the distribution of problems in the Security, System, and Application Logs. Drilling down on any of these logs shows the various problems in the logs and their distribution. For example, drilling down on the Applications log shows problems message was not found and shutting down. At this point, you can click a problem to run XpoSearch to find all events in the log in the timeslot of the measurement point, which contain this problem. For example, clicking message was not found automatically runs XpoSearch for "message was not found" in log.Application.
To view the distribution of problems:
- Hover over a measurement point in the graph.
A table displays the distribution of problems in the entities under the selected View Type (Folders and Logs, Applications, or Servers).