Active Channels

Almost all event-related views are active channels. Also, several types of resources related to assets and cases are shown as active channels.

Rather than simply flowing events through as received, or capturing a fixed set of events for replay, a channel is in effect a live, on-going event query. Because it is continually re-evaluated, the set of events collected in a channel can continue to change (due to reporting latency), even when defined with a fixed time-bracket.

In other words, active channels are definitions for collections of events; definitions that are always freshly re-evaluated so the resulting sets are as valid as the data received up to that moment. Because the active channel continuously refreshes with live events, you should not use an active channel to track event counts because these counts vary across different timeframes. On the other hand, a replay channel’s event count is based on that specific replay session (with the specific sessionID). Instead of active channels, consider using query viewers or reports to track event counts.

The queries that define active channels are composed, at a minimum, of time parameters; other filter conditions of the usual sorts can also apply. You find and use these queries in the Navigator panel's Active Channels resource tree. You create these definitions through the File>New>Active Channel command and can refine them using inline filters and the Active Channel Editor. Once defined and displayed, you can manipulate the order, format, and content of these views with all the familiar features of the Console.

Query viewers are provided as a quick alternative to active channels, better suited to some scenarios. See Query Viewers for more information.