Information on the Overview tab for a Log Analytics group
Summarize
Summary of Overview tab for a Log Analytics group
The Overview tab in Health Log Analytics provides a comprehensive view to help ServiceNow customers understand and analyze Log Analytics groups. It consolidates key information about alert correlations, grouped alerts, configuration items, and impacted services to streamline incident investigation and resolution.
Show less
Key Features
- Correlations banner: Displays the correlation score of alerts based on time proximity, matching metadata (such as host names), similarity in message text, and trend patterns in metrics. This helps identify related alerts that likely represent a single underlying issue.
- List of correlations: Shows detailed groupings of correlated Log Analytics alerts, highlighting the common log correlator (e.g., IP address or user name) that links alerts together. The interface allows expanding these correlations to view individual alerts within each group.
- Alerts in group section: For a selected Log Analytics alert, this section lists all grouped alerts associated with it, enabling customers to drill down into specific alert details for better analysis.
- Configuration Items tab: Provides access to detailed information about the configuration items (CIs) related to the alerts, supporting deeper investigation into affected assets.
- Impacted services tab: Displays services impacted by the alerts, offering insight into business impact and helping prioritize remediation efforts.
How This Helps ServiceNow Customers
By using the Overview tab, customers can quickly assess related alert groups and understand their correlations, which enhances root cause analysis and reduces alert noise. Access to configuration items and impacted services supports effective incident management by linking alerts to tangible IT assets and business services. The tab’s organization streamlines workflows for operators analyzing and acknowledging alerts, improving operational efficiency.
The alert Overview tab in Health Log Analytics helps you understand Log Analytics groups.
Sections on the Overview tab for Log Analytics groups
For a detailed description of Log Analytics groups, see Types of Health Log Analytics alerts.
- Correlations banner
During initial analysis, alerts are scored. Each correlation in the alert's log data with another alert contributes to the score. The higher the score, the more likely the alert is to be included as a Log Analytics alert in a Log Analytics alert.
The following kinds of data are considered when determining whether alerts are correlated:
- Time: The events all occurred within a configured time interval.
- Metadata: The alerts have matching values in log-line metadata. For example, all alerts involve the same host.
- Message text: The message text in the log data is similar or identical between alerts.
- Trend: The alerts show a similar tendency in values or rates. For example, a particular metric value is increasing in all alerts.
Click the More info link on the Correlations banner to view the list of correlations that relate the Log Analytics alerts.Figure 1. Correlations banner 
Figure 2. Correlations - List of correlations: The first correlation in the list is expanded to show the individual Log Analytics alerts that are correlated and the log correlator that the alerts share. The number in parentheses is the number of alerts in the correlation.
- An individual log correlator: The identifier for a group of correlated Log Analytics alerts. The alerts are grouped by the log-line data or metadata that is common to the alerts (for example, IP address, host name, or user name). The number in parentheses indicates the number of correlated alerts.
- Log Analytics alerts that are correlated.
- Alerts in group
For a Log Analytics alert (Alert0010166 in the example), the Alerts in group section shows the Log Analytics alerts that are grouped under the Log Analytics alert.
Click a Log Analytics alert to view its details. To view the full list of Log Analytics alerts, click View more or click the Alerts in group tab.
Figure 3. Viewing alert details - Configuration Items
- To view more detailed information on the CIs that are associated with the alerts, click the Configuration Items tab or click View more in the Configuration Items section. See Operator phase 1: Analyze and acknowledge an alert.
- Impacted services
- To view detailed information on the services that are impacted by the alerts, click the Impacted services tab. See Operator phase 1: Analyze and acknowledge an alert.