During processing of active and completed sessions, Tealeaf events are created based on user-defined circumstances. The data that is derived from events is stored with the actual hit and session information and can be searched like captured data.
Note: The terms Latest 5 minutes and Last 15 minutes (or Last 30 minutes) have different meanings. A search for Latest 5 minutes uses the Available dates timestamps, using the 5-minute search interval computed on the timestamp of the most recent session completed and indexed in the canisters. On the other hand, Last 15 minutes refers to the current time of day, which is different from the latest session. This might not cause noticeable differences if you have a lot of traffic. If there are many sessions being recorded, you will probably get varying results from these two searches.
Searching for events whose trigger is
End of Session or whose reporting is set to
Report last occurrence can require adjustments to your search timeframe, as the event time associated with these events is in the past because of the must wait for the session timeout.
Note: If you create hit attributes from the request buffer, note that the
[HitType] section and
[TLFID_*] sections (where
* is the identifier for the fact) are generated by the event engine and cannot be detected in live sessions. As a result, any events by using these hit attributes do not fire in the Windows™ pipeline and are therefore not available for searching. They do fire, however, when they are evaluated in the Event Tester on sessions that are already passed through the Canister.
Note: You can search for inactive events, which can contain no data, as long as they are configured for display in the Portal. You cannot search for events that are configured to discard the session.
When you search for active sessions for events, the Event Selector does not contain events that meet any of the following conditions:
- Events that are triggered on the
End of Sessionor
Last Hittriggers have not been triggered yet for active sessions.
- Events that are configured to report the last occurrence, which cannot be assessed until the session is closed.
Events that meet any of the conditions mentioned are filtered from the Event Selector.
- In the Event in the Search Configuration area of the Search page, select Include or Exclude.
Include- returns sessions that include the data specified in the search. This is the default setting.
Exclued- returns sessions that exclude the data specified in the search.
- Click Select Event to launch the Event Selector.
- Select an event.
Note: When you select an event, by default, the search configuration looks for the event in combination with any dimension. If needed, you can look for instances of the event that match only a selected dimension.
Dimensions can be configured to capture contextual information from the session at the time when an event occurs. For example, you can capture into a dimension the value of the URL for the page where the event occurred.
By default, the dimension filter is set to
<Any Dimension>, which corresponds to the
No Report Group Dimension.
- Optional: To apply a dimension filter, click Select Dimension.
- In the Dimension Selector, filter the displayed dimensions .
- Select a dimension.
Note: You cannot directly search for null values. To search for a null value, perform a
not includesoperation on the non-null dimension values.
Note: You cannot search for a specified dimension without selecting a value. Wildcard searches on a dimension value are not supported.
- After you select a dimension value, click Select.
The Event search term is updated with a reference to the name of the dimension and the value you selected.
Dimensions and their values are configured in the Event Manager.
Note: If multiple facts are available that meet the search criteria, the oldest dimension is selected based on creation time, since it is likely to have the most data.
Event timestamps are recorded at the time that the event occurred in the session.
Individual events are triggered at the following trigger points:
- Beginning of session
- First hit
- Each hit
- Last hit
- End of session
Depending on when the event was triggered, there can be impacts on searching for session data.
Note: Since events are recorded at the time they occurred, you can sense mismatched counts in events if you are searching for a session that ends in a different hour. For example, if the event fires at 11:55 and the session ends at 12:05, search drill-downs look for sessions in the 11–12 bucket yet will not discover the specific session, which ended in a different hour. Reporting data is more accurate, but drill-downs can show discrepancies.
The alert service uses the timestamp of the event to put the counts into 1-minute time intervals. These intervals are used to determine if an alert threshold is met.
Tealeaf session data files are stored in session files by day, which is defined by the timestamp of the last hit of the session that is compared to the GMT definition of a day.