Normalization Packages¶

Adding a Normalization Package¶

1. Go to Settings >> Knowledge Base from the navigation bar and click Normalization Packages.

2. Click Add.

3. Provide a Name and a Description of the Normalization Package.

4. Click Submit.

5. To add signatures, click Signatures icon under Actions.

6. Click Add.

7. In Pattern, enter the signature.

8. In Example, enter the log message resembling the signature. Providing an Example is optional.

9. Click Check Pattern to check if the signature matches the example.

   

   Checking a Signature Pattern¶

   Note

   Click the ? symbol near the top-right corner to get help on the inputs.

10. Use Key Values fields to attach other values to a signature. For example, for a particular signature that captures process failure, you can add a key-value as object = “process” and status = “failure”.

11. Use Replace Keys fields to replace a key-value pair with another one. For example, if there is a field host_user in a log, you can replace this with host using the Replace Keys textfields.

12. Click Save.

13. Click Submit. You can add as many signatures to the package as you need.

14. Once you create the signatures, you can sort them. Click Re-Order.

15. Click Definers to view the Signature Definers. For more details, go to List of Definers.

Deactivating Signatures¶

1. Go to Settings >> Knowledge Base from the navigation bar and click Normalization Packages.

2. Click the View Signatures icon under Actions column of the respective normalization package.

3. Deselect the signatures that you want to deactivate.

4. Click Submit.

Only the selected signatures are used to normalize log messages.

Exporting Normalization Packages¶

You can export a normalization package from one machine and import it in other machines to save configuration time.

1. Go to Settings >> Knowledge Base from the navigation bar and click Normalization Packages.

2. Select the drop-down at the top-left and click My Packages.

3. Select the normalization packages you want to export.

4. Click Export.

5. Save the exported file.

Importing Normalization Packages¶

You can import normalization package of other devices to save configuration time.

1. Go to Settings >> Knowledge Base from the navigation bar and click Normalization Packages.

2. Click Import.

3. Browse for the Normalization Package.

4. Click Upload.

Editing a Normalization Package¶

1. Go to Settings >> Knowledge Base from the navigation bar and click Normalization Packages.

2. Click the Name of the package to edit.

3. Update the information.

4. Click Submit.

Cloning Normalization Packages¶

You can clone a normalization package to modify it with minor changes and save configuration time.

1. Go to Settings >> Knowledge Base from the navigation bar and click Normalization Packages.

2. Click the Clone Package icon under Actions.

   

   Cloning a Normalization Package¶

   1. To clone multiple normalization packages, select the respective packages. Click the More drop-down and choose Clone Selected Packages.

   

   Normalization Packages¶

   2. To clone all the normalization packages, click the More drop-down and choose Clone All Packages.

   

   Normalization Packages¶

3. Enter a new Name for the cloned package.

4. Select the Replace checkbox to replace an existing package with the same name.

5. Click Clone.

Deleting Normalization Packages¶

1. Go to Settings >> Knowledge Base from the navigation bar and click Normalization Packages.

2. Click the Delete icon under Actions column for the package.

   

   Deleting a Normalization Package¶

   1. To delete multiple normalization packages, select the packages. Click the More drop-down and choose Delete Selected Packages.

   

   Normalization Packages¶

   2. To delete all the normalization packages, click the More drop-down and choose Delete All Packages.

   

   Normalization Packages¶

3. A delete confirmation dialog box appears on the screen. Click Yes on the confirmation box.