Pipeline Troubleshooter

The Pipeline Troubleshooter is an AI-powered assistant that helps you investigate what is happening in your BigPanda event processing pipeline. Ask natural-language questions about incidents, enrichment, correlation, maintenance, environments, and filtering to get detailed explanations with supporting evidence.

Use the Pipeline Troubleshooter when you need to understand why your pipeline produced a specific result, for example why an alert was suppressed, why two alerts landed in separate incidents, or why an expected tag is missing.

Limited availability

This feature has limited availability. If you are interested in enabling this functionality for your organization, contact your BigPanda account team.

Key Features

Natural-language investigation across nine pipeline areas, including enrichment, correlation, maintenance, environments, and alert filtering.
Multi-turn conversations that remember incident and entity context across follow-up questions.
Read-only investigations backed by live pipeline data, with confidence scoring and an expandable execution trace.
Direct launch from an incident in the BigPanda console for one-click investigation.
BigPanda Query Language (BPQL) expression evaluation against real entity and incident data.

Investigate your pipeline

Before you start

Confirm that the Pipeline Troubleshooter is enabled for your organization. If you do not see it in the Settings menu, contact your BigPanda account team.
Have the incident ID, entity ID, or tag name you want to investigate ready. The Pipeline Troubleshooter answers most questions faster when you include a specific ID.
Make sure your BigPanda session is active. Investigations require an authenticated session.

The Pipeline Troubleshooter does not require any additional role or permission beyond access to the BigPanda console.

Investigate directly from an incident

You can launch the Pipeline Troubleshooter directly from an incident in the BigPanda console. When you do, the agent automatically begins investigating that incident. You don't need to type a question first.

The agent sends an initial message of "Investigate incident <incident_id>" and begins its analysis immediately.

Investigate from the Pipeline Troubleshooter screen

The Pipeline Troubleshooter is available under Settings. Navigate to Data processing > Pipeline Troubleshooter.

The welcome screen displays suggested questions to help you get started. Select any suggestion, or type your own question in the input field.

Type your question in the input field at the bottom of the screen and press Enter to send. To add a new line without sending, press Shift + Enter.

Questions can be up to 2,000 characters. A character counter appears as you type.

Troubleshoot your pipeline

Investigation in progress

While the agent is working, a real-time progress indicator shows:

The current phase: Thinking (analyzing your question) or Investigating (querying data).
Which tools are running, along with their status (in progress, succeeded, or failed).
Elapsed time.

To stop an investigation, click Cancel.

Response

Each response includes:

Field	Description
Answer text	Formatted in Markdown. May include tables, code blocks, and lists.
Confidence level	Colored badge representing strength of evidence. High (green): The agent found strong evidence to support its answer. Medium (yellow): The agent found partial evidence or made reasonable inferences. Low (red): The agent could not find sufficient evidence and is providing its best assessment.
Tools used	The number of data lookups the agent performed to answer your question.
Execution trace	A detailed breakdown of each step the agent took, including which tools it called and how long each step took.

To copy the full response to your clipboard, click the copy icon on the response. Code blocks within responses also have individual copy buttons.

Retry after error

If an error occurs, a Retry button appears on the failed message. Click it to resend the same question.

Rate a response

Each response includes a thumbs-up and thumbs-down rating control so you can tell us when an answer was helpful or when it missed the mark. Ratings help us improve the Pipeline Troubleshooter for everyone.

Click the thumbs-up icon to record positive feedback. The rating is saved immediately. No further input is required.
Click the thumbs-down icon to open a short feedback form. To help us act on the rating, choose one or more categories that describe what went wrong, and optionally add a comment (up to 500 characters). The Submit button stays disabled until you select at least one category or write a comment. Click Submit to record the rating.
If you change your mind, close the feedback form (click outside the form or press Esc ) without submitting. The rating is not saved.

Ratings are anonymous

Your ratings are visible only to the BigPanda product team, who use them to identify common gaps and improve the agent's responses. Ratings are not shared with other users in your organization.

Follow-up questions

You can ask follow-up questions within the same conversation. The agent remembers the context from earlier messages, so you don't need to re-specify incident or entity IDs.

"Show me incident <incident_id>."
"Why doesn't it have the region tag?"
"What enrichment schemas could add that tag?"

Manage conversations

The Pipeline Troubleshooter saves your conversations so you can return to them later. The sidebar on the left lists your recent conversations, sorted by most recently updated.

Option	Description
Start a new conversation	To start a new conversation, click New Chat at the top of the sidebar, or use the keyboard shortcut Cmd/Ctrl + Shift + N.
Search conversations	To filter conversations by title, use the search field at the top of the sidebar.
Delete a conversation	Hover over a conversation in the sidebar and click the delete icon. A confirmation prompt appears before the conversation is removed.

Deletions are permanent

Deleted conversations cannot be recovered. Conversations are also removed automatically after 30 days of inactivity.

Keyboard shortcuts

Use keyboard shortcuts to interact with the pipeline troubleshooter during an investigation.

Shortcut	Action
Enter	Send message
Shift + Enter	New line
Cmd/Ctrl + B	Toggle sidebar
Cmd/Ctrl + Shift + N	New chat

Example questions

The Pipeline Troubleshooter can answer questions across nine areas of the BigPanda pipeline.

Enrichment

Understand why tags are present, missing, or have unexpected values. For example:

"Why doesn't this entity have the environment tag?"
"What enrichment schemas apply to the host tag?"
"Show me the CSV mapping for schema <schema_id>."

Correlation

Understand why alerts are grouped together or kept separate. For example:

"Why are these two alerts in separate incidents?"
"What correlation patterns exist for my organization?"
"Show me the correlation rules that matched incident <incident_id>."

Maintenance

Understand why an incident or entity is or isn't under maintenance. For example:

"Why is this incident under maintenance?"
"Which maintenance plan affects entity <entity_id>?"
"What post-maintenance actions are configured?"

Environments

Understand why an incident appears, or doesn't appear, in a specific environment. For example:

"Why isn't this incident showing up in the Production environment?"
"What filter rules define the Staging environment?"

Alert filtering

Understand why an entity is suppressed or filtered out. For example:

"Why is this entity being suppressed?"
"What filtering rules match this entity's tags?"

Entity history

Investigate what happened to an entity over time. For example:

"What happened to entity <entity_id> in the last 24 hours?"
"Is entity <entity_id> flapping?"
"Compare entity <entity_a> and entity <entity_b>."

Incident and entity relationship

Look up and inspect incidents and entities directly. For example:

"Show me recent incidents."
"What entities are in incident <incident_id>?"
"Show me the details of entity <entity_id>."

Incident tag configuration

Understand formula tags and primary alert configuration. For example:

"Where does the business_service tag come from?"
"How is the priority_score formula tag calculated?"
"What is the primary alert configuration?"

BPQL

Test BigPanda Query Language (BPQL) expressions against real entity or incident data. For example:

"Does this maintenance plan's BPQL match entity <entity_id>?"
"Evaluate this environment filter against incident <incident_id>."

Limitations

Limit	Value
Maximum question length	2,000 characters
Requests per user	10 per minute
Requests per organization	50 per minute
Conversation history retention	30 days
Maximum investigation time	Approximately 2 minutes per question

If you exceed the request limit, a Rate limit exceeded message appears. Wait a moment before sending another question.

Read only

The Pipeline Troubleshooter is a read-only tool. It can look up and analyze your pipeline data, but it cannot:

Create, modify, or delete incidents, entities, or alerts.
Change enrichment rules, schemas, or CSV mappings.
Modify correlation patterns, maintenance plans, or environment filters.
Access data from other organizations.

If the agent identifies a configuration issue, it describes the problem and suggests what to change. You will need to make the change yourself through the appropriate BigPanda settings page.

Troubleshooting

Message	Cause and action
Session expired. Please refresh the page.	Your authentication session has timed out. Refresh the browser to re-authenticate.
Rate limit exceeded. Please wait a moment.	You have sent too many questions in a short period. Wait approximately one minute and try again.
Connection timed out. Please try again.	The investigation took longer than expected. Try asking a more specific question, or break your question into smaller parts.
Something went wrong. Please try again.	An unexpected error occurred. Try your question again. If the problem persists, contact your BigPanda account team.
The Pipeline Troubleshooter is not visible in the menu.	The feature must be enabled for your organization. Contact your BigPanda account team to enable it.

Next Steps

Add custom tags and metadata to incoming alerts so the Pipeline Troubleshooter can trace where each tag comes from.
Review and tune correlation patterns to reduce the number of separate incidents.
Define environment filters that the Pipeline Troubleshooter can evaluate against incidents.
Learn BPQL syntax so you can write expressions for the Pipeline Troubleshooter to evaluate.

In this section: