Top Value Counts Data Monitor

Data Monitor Name

Enter a data monitor name.

Enable Data Monitor

Select the check box to enable the data monitor and collect data from the Manager. If not selected, the associated viewer configuration will not display any data.

Depending on the permissions associated with the user group to which you belong, you may or may not have an option to Enable (deploy) or disable (un-deploy) the data monitor. For more information, see Enabling or Disabling a Data Monitor.

Restrict by Filter

Specify a filter to focus on events that are of particular interest and to reduce the number of events the data monitor processes. Use a filter when the number of possible Aggregate Field values can exceed the maximum for # of Distinct Events.

Availability Interval

Sets the number of seconds to use as the interval between monitor updates.

Select Field Set

Specify a field set for use in data monitor drill-downs.

When this data monitor is displayed, the user can double-click on a chart area or table row that represents an event to bring up a drill-down channel for that event.

The field set specified here will determine the columns (fields) shown in the drill-down channel. (See Monitoring Dashboards for information on data monitor drill-downs.)

Bucket Size in Seconds

The time dimension for individual event data units. A number of these units make up the value used in Number of Buckets. For example, you might use a value of 300 to create five-minute buckets. Bucket size and frequency (increasing freshness and resolution) does have a performance cost so it is wise to set buckets to run only as small and fast as actually necessary.

Number of Buckets

The overall time dimension to evaluate, expressed as the appropriate number of Bucket Size units. For example, to evaluate the most recent hour using five-minute buckets, you would enter 12. Bucket size and frequency (increasing freshness and resolution) does have a performance cost so it is wise to set buckets to run only as small and fast as actually necessary.

Time Field

Choose the specific event timestamp to use to apply events to time buckets.

# Top Entries

The number of entries to show as "top" values.

# of Distinct Events

This value must equal or exceed the maximum number of values that the Aggregate Field can possibly have. The default is 1,000. The maximum is 10,000. This value controls the upper limit on the number of aggregate field values. If it is smaller than necessary, then when it encounters one more Aggregate Field value than allowed, the Data Monitor resets all the counters, clears the data, and starts over at zero.

If you specify more than one Aggregate Field, the maximum number of possibilities is the product of the possible values of all fields. For example, if you are aggregating by users and zones in an environment with 200 users and 15 zones, the number of possibilities is 200 x 15 = 3,000. If the number of possibilities is larger than the maximum of 10,000, use a filter to reduce them.

Aggregate Field

Specify one or more data fields to monitor. For more information, see Data Fields. To monitor the top 10 source IP addresses, for example, select the Source Address data field from the drop-down menu. If you specify more than one field, the total number of possible combinations is the product of the number of possible values for each field you specify. Make sure that the # of Distinct Events field is large enough to accommodate this number.

Value Field

Specify what the data monitor will use when determining the top value counts: the number of matching events, or the sum of a particular data field value in all matching events.

• To count events, leave this field empty. (This is equivalent to selecting the Aggregated Event Count field. When the Value Field is not specified, the data monitor uses the data field specified in the Aggregate Field to count events.)

• To sum the values from a particular data field, use the data field selector for the "Value Field" attribute to select the desired field.

In either case, counts from aggregated events will be properly adjusted.

Send Audit Events

Specify generation of audit events for this data monitor. By default, audit events are not generated. Refer to Audit Events and look for the audit events under “Top Value Counts Data Monitor.”