Workflow for creating an Insight Pack

This topic outlines the steps that you must complete to create an Insight® Pack.

Before you begin

Create a Data Source using the IBM® Operations Analytics Log Analysis Generic Annotation to determine whether the default annotations provided by IBM Operations Analytics Log Analysis are sufficient to process your log file data. If the results are not sufficient for your requirements, you can develop an Insight Pack for your log file type by completing these steps:

Procedure

  1. Acquire a representative sample of log files. Choose log files with as many different log record patterns as possible.
  2. If you are using the IBM Tivoli® Monitoring Log File Agent to push data to IBM Operations Analytics Log Analysis, create IBM Tivoli Monitoring Log File Agent configuration artifacts for the new data source.
  3. Identify the log file record boundaries, patterns, and so on.
  4. Identify fields for annotation within logical record patterns.
  5. Use the Insight Pack tools to:
    1. Create and test Annotation Query Language (AQL) rules to split log file records and extract relevant pieces of data that you want to index.
    2. (Optional), Create custom logic to perform the split and annotate functions.
    3. Develop the index configuration which describes the characteristics of fields to be indexed.
    4. Create the administrative configuration artifact definitions that are installed with the Insight Pack.
    5. Generate the Insight Pack for testing.
  6. Use IBM Operations Analytics Log Analysis to test that log records, from the log file type, are split, annotated, and indexed correctly.
  7. Validate that the data is split, annotated, and indexed and perform some searches on the indexed fields to verify the results.