Ok, I have to admit that I don't know it all, a recent reading of Socarates has convinced me of my lack of knowledge. My question to you all is....what EXACTLY does response window do? I understand "correlation time" but "response window" is hard for me to grab. I have been unsuccessful at finding decent documentation on its description in terms that I can understand. I know that it must be greater than or equal to the correlation time most of the time.....help anyone? Please.....
Response window is especially relevant for two things:
Correlation time says: these multiple events (in this grouping, whether that's an inner grouping or the correlation in general) all need to happen X times in Y seconds.
Response window says: ALL of the events in the ENTIRE correlation rule need to happen within Y minutes of real-time.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process. Learn more today by joining now.