Filtering Loaded Input Data
Updated: May 20, 2016
Prior to loading data into Message Analyzer through a Data Retrieval Session, there are several methods you can use to limit the data that you load for analysis. These methods, which enable you to create a focused message set based on criteria that you define, consist of the following:
Configure a Session Filter — enables you to “select” specific data from your input file configuration through filtering, to narrow the scope of data retrieval to specific data of interest, reduce the volume of messages that you load, and therefore improve performance.
Choose input files — enables you to select data by combining chosen input files that contain specific data that you want to load into Message Analyzer
Apply a Time Filter — enables you to select data by reducing the scope of loaded messages to a specified time range, by configuring a window of time in which to view data prior to loading such data from saved files.
Choose a Parsing Level — enables you to select data by limiting how far up the message stack Message Analyzer will parse, thereby reducing the number of messages processed and displayed, creating a focused analysis level, and increasing performance.
You can specify a Session Filter for your Data Retrieval Session by either writing your own Filter Expression or choosing a built-in Filter Expression from the centralized filter Library. This Library is accessible in the New Session dialog and it contains the same built-in Filter Expressions that you will find in the Message Analyzer Filters asset collection Library in the View Filter Tool Window.
If you want to specify a built-in Filter Expression from the centralized filter Library when loading data into Message Analyzer, you should first review the filter functions that are described in Filtering Live Trace Session Results and then select an appropriate Session Filter. If you intend to create your own Filter Expression, see the appropriate topic below in the See Also section for more information about how to write one.
After you write a Filter Expression or modify a built-in expression that you want to use as a Session Filter, you have the option to save the new Filter Expression to the centralized filter Library in the New Session dialog. For example, if you want to save Filter Expression code that exists in the Session Filter text box, click the Library drop-down list and select the New Filter command to display the Edit Filter dialog. The text of the target Filter Expression is transferred to the Edit Filter dialog, where you can Verify that the expression compiles properly as a valid Filter Expression before you save it to the Library (by clicking the Save button in the dialog).
Saving a custom Filter Expression to the filter Library is optional. Because you are not restricted from applying such a filter to the data loading process, you can observe its performance prior to saving it. To do this, simply click the Start button in the New Session dialog. When you do, Message Analyzer automatically validates that the expression properly compiles. If the Filter Expression does not compile, you will be unable to load data through this Data Retrieval Session, until you either correct the Filter Expression or delete it entirely. If you have an expression that does not compile, Message Analyzer displays a Compile query Error message.
If your Filter Expression performs as expected and proves to be a useful tool for analysis, you can save it to your centralized filter Library for future use, as previously described. Note that such a filter is added to the My Items category of your Filter Expression Library and is then available to the Sharing Infrastructure, which enables you to share filters with other users.
To learn more about using a Session Filter, see Applying a Session Filter to a Data Retrieval Session.
After using the Add Files command on the toolbar of the Files tab in the New Session dialog to create a list of files that contain the data you want to load through your Data Retrieval Session, feasibly from multiple disparate data sources, you can also apply filtering through file selection to create unique message collections. To do this, simply select specific files from among the files that are marked for loading data in the files list to create a subset of messages that you want to focus on. For each file that you want to include for data loading, place a check mark in the check box next to the file name in the files list of the New Session dialog. You can also specify a data viewer in which to present the loaded data. After you click the Start button in the New Session dialog, the data loading process is silently invoked in the background.
You might have multiple log files containing data that was collected over a period of time from different sources, for example, from a client and server. You might be interested in isolating the source of a TCP connection issue that involved lost TCP segments but it is unclear which machine was dropping packets. You could load data from sets of log files from the same time period, possibly while drilling down to a specific window of time with the use of a Time Filter, to select data that was collected on both client and server computers in a specified time window. When viewing results in an Analysis Session, the data from each set is presented as a single unified message collection with messages interleaved in chronological order. Note that you might also want to configure a Time Shift if the data sets need to be synchronized.
To learn more about creating a time window filter, see Applying an Input Time Filter to a Data Retrieval Session.
To learn more about creating a Time Shift, see Setting Time Shifts.
Message Analyzer provides a built-in Library known as the Message Analyzer Parsing Level asset collection, as indicated in the Asset Manager dialog. This Library is accessible from the Parsing Level drop-down list in the New Session dialog. In the list, the Full value is the default, which means Message Analyzer will parse the full stack for all messages. However, as an example, if you select the Network Analysis item in the list, Message Analyzer will parse up to and including the IP/Network Layer, with a few exceptions for certain TCP, UDP, and other traffic that is predetermined to be valuable for network analysis.
To learn more about Parsing Levels, see Setting the Parsing Level.
You also have the option to edit your Data Retrieval Session after the data loads into Message Analyzer. You can do this by clicking the Edit Session button on the global Message Analyzer toolbar. Thereafter, the Edit Session dialog displays, from where you can choose another Session Filter or configure a different one. Note that you can also add or remove files in the files list on the Files tab and you can change the Time Filter and/or Parsing Level configuration as well, as part of your edits. You can then apply the changes you make to the session configuration by clicking the Apply button in the Edit Session dialog and Message Analyzer will process the changes you specified for your Data Retrieval Session.
To learn more about editing a Data Retrieval Session, see Editing Existing Sessions.