4 Replies Latest reply on Jun 26, 2012 2:02 PM by nicole pauls

    Add Filter option to buffer based on "Last XX minutes"


      Currently LEM's filters show the last 1000 alerts, adjustable to 2000 max. When using the Monitor pane, it would useful to change that buffer to display the alerts from a time-based limit (i.e. "last 15 minutes") as well as the quantity-based limit. Understandably, it could still have a max (to not overload the buffer). This time-based limit would allow the Monitor screen to be used like a dashboard and have relevant data in the Filters list rather than almost always showing "1000", like it does when it is left open/up.


      Thank you,


        • Re: Add Filter option to buffer based on "Last XX minutes"
          nicole pauls

          Interesting idea. Behind the scenes, there's a pool of alerts held in memory (on the console side) and the filter is basically just a "view" into the pool. When they expire from all filters, aren't displayed in any filters, and are over the pool's limit, they expire and get recycled. We're already using the time to draw the charts, so it isn't much of a stretch to also use time to narrow the window.


          As you say, we'd have to be careful that the timeframes didn't inflate that bucket. So, it'd be something like "the most recent 2,000 alerts that occurred in the last 15 minutes" if you had more than 2,000 in 15 minutes. What we have now is "the most recent 2,000 alerts that occurred for the entire time I've had the Console open."


          You can of course "delete" alerts (hide them from the filter), but that's a manual operation.


          Thanks for the suggestion, I've recorded it.

          1 of 1 people found this helpful
            • Re: Add Filter option to buffer based on "Last XX minutes"

              Thanks, Nicole. What you said in the second paragraph is exactly what I'm looking for.



                • Re: Add Filter option to buffer based on "Last XX minutes"
                  nicole pauls

                  Hey Chris (and anyone following),


                  We're currently looking at implementing a control like nDepth, where you will have:

                  • Last 10 minutes
                  • Last 30 minutes
                  • Last Hour
                  • Last 2 hours
                  • Last Day
                  • Last Week


                  Some alternative thoughts include focusing more on the short-term:

                  • Last 10
                  • Last 30
                  • Last 60
                  • Last 90 minutes
                  • Last 2
                  • Last 4
                  • Last 8
                  • Last 12
                  • Last 24 hours
                  • Last 5
                  • Last 7 Days


                  This would again do "the most recent <selected number> alerts that occurred in <the selected timeframe>".


                  Are we missing anything obvious in those choices? A preference for any specific time windows or focus? Do you find yourself wishing for something more flexible in the cases you've wanted this functionality?


                  Inquiring minds want to know! Thanks

                    • Re: Add Filter option to buffer based on "Last XX minutes"
                      nicole pauls

                      To follow up on this thread, we're transitioning to the new Ideas model and in the meantime, the old Feature Request discussions will get moved over. I'm ghost posting for cmgurley based on his comments in a private thread. When I get this item moved over to Ideas, we can continue the discussion, if necessary.


                      Chris said:

                      In short, I think the first set of options is mostly on target (I'll add this to the thread when it reopens). Might be nice to go more w/ last 10min, 30min, 1hr, 6hr, 12hr, 1day, 1wk. And if it can pull out of the pool when the console opens (instead of waiting for new data), that'd be great as well.


                      I'll post the second one as a separate idea so we can track votes on that, too.