Timestamps in search and reporting

Generally, the timestamps listed in the Portal are reported in the Tealeaf time zone, which is displayed in the upper-right corner of every Portal page.

For example, when you drill down from a report displayed in the Report Builder, the displayed time zones in the list of sessions are consistent with the times reported in the source report. However, for active search and for reports on active sessions, time information is reported in the time zone selected for the current user.

For example, if you are located in the Pacific time zone, creating and executing a search of today's sessions results in a list of sessions whose timestamps match to the current date in the Pacific time zone. In this manner, you can identify activity that is going on right now by comparing times in active data in the Portal to the time of your local desktop.

Time zone information is displayed in the Portal according to the following table.

Working in the Search page

In the Search page, you can configure a search using the selected search template to look for active, completed, or all sessions that match the criteria you specify.

Each user can select the search template to use.

Search templates are created and configured by your Tealeaf administrator.

The following sections describe each functional area of the Search page.

Search Template

From the Search page, you can choose the search template appropriate for the search you are specifying. Typically, search templates are provided based on the type of session for which you are searching: Active, Completed, or All Sessions. You can also open saved searches, which automatically select the template that was used to create them. Search templates are defined and assigned by your Tealeaf administrator.

The currently selected search template is displayed as a hyperlink above the search panels. To select a different search template, click the search template hyperlink. The Template Selector is displayed:

Select the template to use in the Template Selector.

After you complete your search, the Search page remembers the last template that you used for the current type of search. If you switch from Active search to Completed search, for example, the Search page loads the last template used for Completed search.

Depending on whether you select an Active, Completed, or All Sessions search template, the available options for the following search features may change:

• Available search fields
• Search options
• Search scope

Search Template Types

Tealeaf monitors a visitor's interaction with a web application during a session. Tealeaf provides default templates for active, completed, and all session searches.

Search Options

Each Search Template has its own search options. Depending on the type of search template that you select, the following options are displayed:

The Search Range field

When searching completed sessions, you can use the Search Range field to search for completed sessions within a specified range of time.

To search the widest possible date range of all sessions stored in all active Canister and Selective Archive servers, select Available Dates.

Tealeaf administrators can define the set of active Canister and Selective Archive servers in the Portal Management page.

Search fields

In the left panel of the Search Page, you can select the search fields to include in your search. You can include up to six search fields. Depending on the selected search template, one or more of the following groups of fields is available in the Search Fields panel.

The Configuration window

In the Search Configuration window, you can specify the scope of the search and enter or select specific data for each of your selected search fields.

The Search scope

From the Search Scope field, you can select how the populated search fields are logically bound in the search.

Notes on AND Searches

When an event fires, it is recorded in the report database with the reference values at the time the event fired. When you drill into a hit-based report, a search is run to return relevant results, which may return session counts that do not match expectations based on the report data.

If you specify an AND search with only a single search term, the Portal automatically converts it to a single-term search so that sessions are returned.

Text searching is session-based. When a search is run, any session containing the dimension value and the event is returned, even if the dimension value on the hit where the event fired is different from the dimension value in the search. For this reason, a higher number of sessions may be displayed when drilling into the initial session list.

For example, suppose you have two 4-page sessions:

• Session 1 has page 1 with dimension value App1. On page 4, the value is App2 when Event 1 fires.
• Session 2 has page 1 with dimension value App2. On page 4, the dimension value is App1 when Event 1 fires.

Suppose that you are viewing a report that identifies the occurrence of App2 on the first page of the session. When you click the drill-down link, the Portal essentially specifies the following search:

Event=Event 1 and Application=App2

Since search is session-based, the logical and is applied to the entire session, not to the individual hit. When this search is run, both of Session 1 and Session 2 are returned, as Event 1 and App2 is displayed somewhere in the session.

The report data displays a count of 1 for Event 1 with dimension value App2. However, when you drill down, two sessions are returned, because both sessions have dimension value App2 and Event 1.

For the above example, you can generate search results through the Portal search interface that are consistent with the report data by specifying the search terms and the following conditions:

• Apply a logical AND
• Specify the data/time range appropriately
• Apply And on same page in the search specification, if filtering a dimension value other than Path. By default, And on same page is applied to searches by using the Path filter.
  Note: And on same page searches are available only for completed sessions.

Working with Search Configuration

Each search template has a list of search fields that are associated with it. You can add a search field by selecting the field in the list.

• You can add up to 10 search terms to a search.
• Fields can be selected more than once and specified independently.
• Fields left empty when the search is submitted are ignored. If no fields are specified, all sessions that are meeting the other constraints are returned.
• Searches by using Boolean search terms can be applied to a single session fragment only, as the underlying search engine is unaware of fragmentation. If the session contains multiple fragments, search results can be inaccurate. Through RTV, you can retrieve search results for one search term and then perform a search of the returned sessions for the other term.

Depending on the type of search field, different configuration options are available.

Search optimization tips

If your search is taking a long time to complete, there are some things you can do to optimize its performance.

When you configure a search, the following tips can help return faster and better results:

• Searches of completed sessions are faster than active sessions because completed sessions are indexed.
• Avoid doing free text searches of the request or the response. Use keywords and provided search fields instead.
• For completed session searches, try to minimize the date range to only the relevant dates.

Search processing

When you click the Search button, the Tealeaf system performs a set of actions in sequence as described in the following list.

1. The Portal passes the search query to the Report Server.
2. The Report Server examines the query.

   If the search spans multiple Search Servers, the Report Server farms out pieces of the request to the Search Server on each relevant Canister Server.

3. Each Search Server examines its part of the request and determines the session indexes that must be searched.
4. Those indexes are searched for matches.
5. Information about matching sessions is retrieved from the indexes and sent back to the Report Server.
6. The Report Server collates the results and delivers them back to the Portal for display to the user.

If you are searching across multiple servers, duplicate search hits and sessions are removed. The number of returned sessions reflects the number of unique sessions that returned, capped by the maximum permitted number of returned sessions. The number of sessions that are found is not adjusted to reflect any duplicate sessions that were found yet not returned due to the maximum number of sessions setting.

You can select individual Search Servers to query as part of your search criteria

Search keywords

Tealeaf includes search keywords. Review the search keywords available in Tealeaf and to understand how they are implemented in each storage mechanism.