This page displays two lists:
Running Processes: lists the detection processes that are
currently running. For each running process the start time and
progress status are displayed, and it is possible to stop the
process or delete it.
Completed Processes: lists the detection processes that
have been completed. For each completed process the start and
end times are displayed, and it is possible to view the detection
results or delete the process.
In order to start a new transaction detection
process, click the 'New Process' link in the top-right of the
page.

Before starting the transaction detection process, you should
specify the following details:
Process Name: the name of the process.
Time Frame: you can specify the time frame from which
events should be processed. Only events that match the time
frame will be included in the processing.
Search Terms: you can specify a list of terms that are
contained in the events that should be processed. Only events
that match one of the search terms will be included in the
processing.
Transaction Logs: you should specify the logs that are
candidates to participate in the transaction(s). The logs tree is arranged by hosts -> applications -> folders -> logs.
Click the 'Start Detection Process'
link to start the processing. A page displaying the progress of
the processing will be displayed. You can stop the processing at
any time by clicking the 'stop' link in the processing page.
Once the processing is over you will be redirected to the
results page.

The transaction detection results page
lists the transactions that were detected by TransactionExpo.
You can view the details of the process that lead to the current
results by clicking the 'show process details' link. From this
section it is possible to edit the name of the process and save
it by a different name.
For each result, the following details
are listed:
Transactions: the number of transactions that were
detected and the percentage out of the total number of
transactions that were detected.
Events: the number of events that participate in the
transactions that were detected and the percentage out of the
total number of events that participate in all the transactions
that were detected.
Average Duration: the average time of all the transactions.
Permutations: the number of sub transactions that were
detected. During the transaction detection process, transactions
that have similar structure are merged into the same result.
Hosts: the number of hosts that participate in the
transactions that were detected. You can toggle between logs
view and hosts view by clicking the relevant tab in the right
side of each result.
Logs: the number of logs that participate in the
transactions that were detected. You can toggle between logs
view and hosts view by clicking the relevant tab in the right
side of each result.
Above Average: the number, percentage and time range
displayed are controlled by the Time Distance control of the results page,
as explained below.
Below Average: the number, percentage and time range
displayed are controlled by the Time Distance control of the results page,
as explained below.
Average Edge Time: the time displayed on each edge in the
graph is the average time of an edge, in all the transactions that were
detected.
For each result, it is possible to
drill down to its permutations by clicking the 'Permutations'
link.
For each permutation, it is possible to drill down to its
instances by clicking the 'Instances' link.
When the results page is viewed, a
control panel is opened in the left-hand side of the screen:

The available controls are:
ID: this control can be used to filter the results by the
given ID, for example an IP address or a session id.
Min-Max Time: this control can be used to filter the
results by time range.
Tx Percentage: this control can be used to filter the
results by the percentage of the transaction's result.
Time Distance: this control can be used to update the
'Above Avg.' and 'Below Avg.' fields of the results. The time
distance percentage range is the percentage of the time between
the average transaction duration and the longest/shortest
transaction duration. For example, in the first result shown
above the average duration is 21.71 minutes, the minimal
duration is 10.42 minutes and the maximal duration is 29.95
minutes. If we change the time distance value to be 10% - 100%,
the 'Above Avg.' field will show 6 transactions in range 22.53
min - 29.95 min (the minimal time is now 22.53 minutes which are
equal to 21.71 minutes, the previous minimal value, to which we
add 10% of the difference between 29.95 minutes, the maximal
duration, and 21.71 minutes, the average duration, which are
0.82 seconds). In the same way, the 'Below Avg.' field will show
4 transactions in range 10.42 min - 20.58 min (the maximal time
is now 20.58 minutes which are equal to 21.71 minutes, the
previous maximal value, from which we subtract 10% of the
difference between 21.71 minutes, the average duration, and
10.42 minutes, the minimal duration, which are 1.13 seconds).
In order to activate the controls you
should set the desired values of the controls and press the 'Go'
button.
If you wish to save one of the results
as a transaction definition in TransactionExpo, click the 'Save
as transaction' link (you will be prompted to specify the name
of the transaction definition).
If you wish to save one of the results as a transaction
definition in TransactionExpo and immediately create a result
set, click the 'Save as transaction and execute' link (you will
be prompted to attach the new transaction definition to an
existing/new workspace and project, and specify
the name of the transaction definition). |