1 of 1 people found this helpful
Interesting idea. Behind the scenes, there's a pool of alerts held in memory (on the console side) and the filter is basically just a "view" into the pool. When they expire from all filters, aren't displayed in any filters, and are over the pool's limit, they expire and get recycled. We're already using the time to draw the charts, so it isn't much of a stretch to also use time to narrow the window.
As you say, we'd have to be careful that the timeframes didn't inflate that bucket. So, it'd be something like "the most recent 2,000 alerts that occurred in the last 15 minutes" if you had more than 2,000 in 15 minutes. What we have now is "the most recent 2,000 alerts that occurred for the entire time I've had the Console open."
You can of course "delete" alerts (hide them from the filter), but that's a manual operation.
Thanks for the suggestion, I've recorded it.
Thanks, Nicole. What you said in the second paragraph is exactly what I'm looking for.
Hey Chris (and anyone following),
We're currently looking at implementing a control like nDepth, where you will have:
- Last 10 minutes
- Last 30 minutes
- Last Hour
- Last 2 hours
- Last Day
- Last Week
Some alternative thoughts include focusing more on the short-term:
- Last 10
- Last 30
- Last 60
- Last 90 minutes
- Last 2
- Last 4
- Last 8
- Last 12
- Last 24 hours
- Last 5
- Last 7 Days
This would again do "the most recent <selected number> alerts that occurred in <the selected timeframe>".
Are we missing anything obvious in those choices? A preference for any specific time windows or focus? Do you find yourself wishing for something more flexible in the cases you've wanted this functionality?
Inquiring minds want to know! Thanks
To follow up on this thread, we're transitioning to the new Ideas model and in the meantime, the old Feature Request discussions will get moved over. I'm ghost posting for cmgurley based on his comments in a private thread. When I get this item moved over to Ideas, we can continue the discussion, if necessary.
In short, I think the first set of options is mostly on target (I'll add this to the thread when it reopens). Might be nice to go more w/ last 10min, 30min, 1hr, 6hr, 12hr, 1day, 1wk. And if it can pull out of the pool when the console opens (instead of waiting for new data), that'd be great as well.
I'll post the second one as a separate idea so we can track votes on that, too.