Unified Analytics Reporting Data Tables

A list of the fields available for reporting on using Unified Analytics.

Unified Analytics uses transformed data tables for report metrics and data relationship mapping. Some of these data tables may have been adjusted to fit the custom tags of your organization.

Available Tables

Incident Start Time (Dim)

Alerts (Dim)

Alert Processing (Fact)

Incident Activities (Dim)

Users (Dim)

Incident Processing (Dim)

Incidents (Dim)

MTBF (Fact)

🚧

The fields in the data model are configured during your migration or implementation and cannot be changed by Designers. Reach out to BigPanda support to add or change any data columns, for example to change timezones, concatenate tag fields, or whitelist specific fields from the Incident or Alert Tags.

Table Relationships to BigPanda Events

  • Alerts enter BigPanda (Entities)
  • Alerts are enriched with metadata and enrichment tags (Alert Tags)
  • Alerts are correlated into BigPanda Incidents (Incidents)
  • Alerts are further enriched automatically and manually with Incident Tags (Incident Tags)
  • The system and users take action on the incident, such as commenting, sharing, and entering or ending the flapping state (Incident Activities)

The Date table is provided in our data model to enable multiple time zone support and is based on Incident Start Date. Customers can request other data fields in their timezone as needed.

The Mean Time Between Failures table provides aggregated metrics on the frequency of alerts at the Host/Check level for ease of reporting in the Mean Time Between Failures widget. For details on TTx metrics (assign, detect, resolve) for individual incidents, refer to the Incident Metrics table instead.

To learn more about how BigPanda deduplicates, correlates, and enriches alerts into incidents, see the Manage Alert Correlation documentation.

To learn more about how BigPanda processes, enriches, and resolves incidents, see the Incidents in BigPanda documentation.

To learn more about using Reporting Tables in BigPanda, see the Unified Analytics documentation.

Reporting Data Tables

Reporting Data Tables

Incident Start Time (Dim)

The Date table is provided in our data model to enable multiple time zone support and is based on Incident Start Date.

Column NameDescriptionData TypeNotes
datetime (utc)The translated event time in UTCDate/Time
datetime (pst)The translated event time in PSTDate/Time
datetime (mst)The translated event time in MSTDate/Time
datetime (cst)The translated event time in CSTDate/Time
datetime (est)The translated event time in ESTDate/Time
datetime (india)The translated event time in India time zoneDate/Time
day of the week # (utc)The numerical day of the week the system event occurred in UTCInteger0=Sunday - 6=Saturday
day of the week # (pst)The numerical day of the week the system event occurred in PSTInteger0=Sunday - 6=Saturday
day of the week # (mst)The numerical day of the week the system event occurred in MSTInteger0=Sunday - 6=Saturday
day of the week # (cst)The numerical day of the week the system event occurred in CSTInteger0=Sunday - 6=Saturday
day of the week # (est)The numerical day of the week the system event occurred in ESTInteger0=Sunday - 6=Saturday
day of the week # (india)The numerical day of the week the system event occurred in India timezoneInteger0=Sunday - 6=Saturday
Incident Start - Filter (utc)The translated event time in UTCDate/TimeThis field should only be used in filters, not dashboard widgets
Incident Start - Filter (pst)The translated event time in PSTDate/TimeThis field should only be used in filters, not dashboard widgets
Incident Start - Filter (mst)The translated event time in MSTDate/TimeThis field should only be used in filters, not dashboard widgets
Incident Start - Filter (cst)The translated event time in CSTDate/TimeThis field should only be used in filters, not dashboard widgets
Incident Start - Filter (est)The translated event time in ESTDate/TimeThis field should only be used in filters, not dashboard widgets
Incident Start - Filter (india)The translated event time in India time zoneDate/TimeThis field should only be used in filters, not dashboard widgets

Alerts (Dim)

Each alert is the aggregated group of each alert status update and changes in BigPanda. See Alerts for more information.

Column NameDescriptionData TypeNotes
alert_idThe unique identifier of the alertString
source system (system code)The monitor system that sent this alertString
alert start time (epoch)The unix time the alert startedInteger
alert last changed time (epoch)The unix time for the last change made to an alertInteger
alert end time (epoch)The unix time for the resolution of the alertInteger
alert statusThe current status of the alertStringOk, Critical, or Warning
alert highest severityThe highest status the alert reported at any timeStringCan be used to find alerts that were critical at any point
alert start date/time (utc)The date/time that the alert startedDate/Time
alert end date/time (utc)The date/time when the alert resolvedDate/Time
source systemThe monitor system that sent the alert (cleaned)String
primary_property_keyThe tag name of the primary propertyString
secondary_property_keyThe tag name of the secondary propertyString
BP Business SegmentA business portion or unit that drives unique action or functionality.StringFor example, a high-level Business Unit, Team, Group, or Organization.

Default fields are:
bp_v_business_segment
bp_group
bp_assignment_group
assignment_group
BP Config ItemAn aggregated field used to capture the relevant configuration item.StringDefault fields:
host
application
bp_application
service
bp_service
bp_v_config_item

A custom field can also be set.
BP Business CategoryA logical type of alert that can be connected to a meaningful function, service or a recurring topic.StringThis can be a function like application, infrastructure, service, etc.

Or it can be a more technical alert category like latency, load, etc.

Default fields are:
bp_v_business_category
bp_category
alert_category
Alert dedup keyField used to identify duplicate incoming alertsString
alert tag columns *String value of alert tag, defined by column nameStringThe alert tags that are listed in Unified Analytics reporting are dynamic and will depend on your organization’s enrichment tags.

Each tag will have its own value column

For example, you may see columns for host, app_tier, escalation_team, alert_category, etc.

Alert Processing (Fact)

All tags of an alert with normalized fields.

Column NameDescriptionData TypeNotes
alert_idThe unique identifier of the alertString
incident_idThe unique identifier of the incidentString
alert status changesThe number of times the alert has changed statusIntegerStatus count includes the initial status. Changes to the “ok” statuses are not counted

(if an alert has an initial status of critical, then changes to warning, then to ok, then to critical, then to ok, the status count would be 3)
alert start minuteThe unix time the alert started in minutesInteger

Incident Activities (Dim)

A single action a user performed in BigPanda.

Column NameDescriptionData Type
a.activity_idThe unique identifier of the activityString
a.incident_idThe unique identifier of the incidentString
a.creator_user_idThe id of the user that took the action in BigPandaString
created_ timeThe unix time the action was takenInteger
activity start minuteThe unix time the activity was initiated in BigPandaInteger
activity environmentThe name of the environment the activity took place inString
activity commentThe comment that was included with the activityString
share targetThe name of the system the related incident was shared toString
shared activity target (system code)The BigPanda unique identifier of the system the related incident was shared toString
flapping_stateWhether or not the related incident is flapping.

True indicates that the incident is currently flapping.
False indicates that the incident was flapping at one point, but isn’t currently.
N/A indicates that the incident has never been flapping.
Boolean
activity typeThe type of activity (cleaned)

The following activity types are available:

assigned
become-flapping
commented
external-resolve
manual-resolve
merge
shared
snoozed
split
unassigned
unsnoozed
String

Users (Dim)

Users who perform actions on an incident.

Column NameDescriptionData TypeNotes
user_idThe unique identifier of the user who performed the actionString
nameThe BigPanda UI name of the user who performed the actionString
emailThe email address of the user who performed the actionString
rolesThe access roles assigned to the user who performed the actionString

Incident Processing (Dim)

Pre-aggregated metric totals for Time to Assign / Detect / Resolve (TTA, TTD, and TTR)

Column NameDescriptionData TypeNotes
incident_idThe unique identifier of the incidentString
incident start minuteSystem field - can be ignoredInteger
time to assign (mins)Number of minutes to assign the incidentInteger
time to engage (mins)Number of minutes before action was taken on the incidentInteger
time to resolve (mins)Number of minutes to resolve the incidentInteger

Incidents (Dim)

A single BigPanda incident

Column NameDefinitionData TypeNotes
time to assign (mins)Number of minutes to assign the incidentInteger
time to engage (mins)Number of minutes before action was taken on the incidentInteger
time to resolve (mins)Number of minutes to resolve the incidentInteger
first_actionThe unix time the first action was taken on the incidentInteger
incident start time (epoch)The unix time the incident startedInteger
Incident start date/time (UTC)The date/time the incident startedDate/Time
incident end time (epoch)The unix time for the resolution of the incidentInteger
Incident end date/time (UTC)The date/time for the resolution of the incidentDate/Time
incident last changed time (epoch)The unix time for the last status changeInteger
incident statusThe current status of the incidentStringOk, Critical, or Warning
incident highest severitythe highest status of the incidentStringCan be used to differentiate incidents that were critical at any point
manual_correlationDid a BP user manually correlate the incident in BP UIBoolean
incident_hyperlinkURL with the org's "All incidents" environment and incident ID splicedStringCan be used in Tables/Aggregated Tables to provide hyperlinks to the Incident
BP Incident QualityBigPanda categorizes alert quality based on the amount of enrichment or context available.IntegerHigh Quality Alerts - Contains all important data needed for a team to triage and resolve the alert, with focus on business context.

Medium Quality Alerts - An alert that contains the minimum level of information and technical context to support operator action. These alerts lack some valuable elements such as business context, dependencies, or resolution steps.

Low Quality Alerts - Alerts that lack key information or which were identified as irrelevant or misconfigured
BP Incident ClosureA classification field on the workflow status of an incidentStringBased on actions, incidents are categorized as:

Shared - The incident was manually shared
Auto Shared - The incident was AutoShared
Auto Resolved - The incident was resolved externally
Missed - The incident resolved itself without intervention
No Action - The incident was resolved manually with no other action
Resolved in BP - The incident was resolved within BigPanda
Still Open - The incident is still open
BP Incident Resolution BucketIncidents are placed in resolution buckets depending upon the time to resolve.StringResolution buckets include the following:

Still Open
Under 5 min
5 - 30 min
30 - 60 min
1 - 4 hours
4 - 24 hours
1 - 7 days
Over a week
BP Incident ActionableAn incident that contains high quality alerts enriched with both technical and business context.BooleanUnified Analytics uses the following criteria to determine if an incident is actionable:

- Explicitly defined as actionable using bp_v_actionable tag
- Enriched with business context (using the bp_v_business_segment tag)
- Incident was acted upon
- Not defined as noise (using the bp_v_alert_noise tag)
BP Incident OutlierIncidents are set as an outlier if:
Assign time is over a day
Engage time is over a day
Resolution time is over a week
If an incident isn’t an outlier, the setting is Valid
Boolean
Num of alertsNumber of unique alerts correlated with the incident.Integer

MTBF (Fact)

Mean Time Between Failures. Calculations to assist with querying the Alert Analysis Report. This table represents aggregated results of the data in the Incident Metrics table. See Unified Analytics Key Metrics for more information about MTBF.

Column NameDescriptionData TypeNotes
MTBF hostThe host (not normalized)String
MTBF checkThe check (not normalized)String
tagsjoinkeyField used to connect MTBF data to the alertString
MTBF Mean Time Between Failures (hrs)The mean time between failuresInteger
MTBF occurrencesThe number of mean time between failures occurrencesInteger
MTBF last seenThe date/time that the mean time between failures last seenDate/Time

Next Steps

Learn how to Manage Unified Analytics Reports

Find definitions of key metrics for Unified Analytics

Learn how to navigate the Analytics tab