Jump to Content
GuidesHome
HomeUser GuidesDeveloper DocsCommunity Forum
HomeLog InGuides
User Guides
Log In
HomeUser GuidesDeveloper DocsCommunity Forum
All
Pages
Start typing to search…

Welcome to Observe

  • Welcome to Observe
  • What's new?
    • Observe platform
    • Observe Agent
      • Observe Agent versioning
      • Versions 2.10.*
      • Versions 2.9.*
      • Versions 2.8.*
      • Versions 2.7.*
      • Versions 2.6.*
    • Helm Chart
      • Versions 0.6*
  • Get help
    • Observe support
      • Terms of support
      • Report an incident
      • Escalate an issue
      • View your requests
      • Share requests with your team
      • Accidental ingestion of sensitive data
      • Observe system user
    • Use o11y AI in Slack
    • Give documentation feedback
    • Observe helpful hints
      • How do I change the name of my Observe Instance?
      • Where do I find my customer ID?
      • How do I create and use formulas?
      • How many Monitors am I using?
      • How many queries am I using?
      • How much ingest and transform are we using?
      • How do I make a service appear in the Service Explorer?
      • What is the System Datastream?

Add Data

  • Get started
  • Observe Agent
    • Install Docker image
    • Install on a host
      • Install on Linux
      • Install on Windows
      • Install on macOS
      • Configure the Observe Agent on Linux, Windows, and macOS
    • Install on Kubernetes
      • Helm Chart components
      • Collect annotations and labels
      • Add and delete attributes
      • Prometheus autodiscovery
      • Application RED metrics
      • Filter logs and metrics
      • Handle multiline log records
      • Mask sensitive data
      • Collect StatsD metrics
      • Collect StatsD metrics using UDS
      • Node affinity, taints, and tolerations
      • Deploy to multiple clusters using Rancher
      • Deploy to a serverless Kubernetes cluster
      • Tune service resource requests and limits
      • Trace tail sampling
    • Install on Amazon ECS
      • Install on Amazon ECS (EC2)
      • Install on Amazon ECS (Fargate)
      • Install on Amazon ECS (Fargate - Sidecar Pattern)
    • Install on Ansible
      • Install on Ansible for Linux
      • Install on Ansible for Windows
    • Fleet Management
    • Manage application data volume
    • Configure your own OTel collector
      • Full host example
      • Full Kubernetes example
    • Troubleshoot the Observe Agent
  • Cloud integrations
    • Get AWS data into Observe
      • AWS-at-scale data ingestion
      • AWS data collection
      • Uninstall an AWS integration
    • Get Microsoft Azure data into Observe
      • Install and configure the Microsoft Azure app
      • Azure resource configuration
      • Azure Active Directory (AD)
      • Azure App Services
      • Azure Cognitive Services
      • Azure Functions
      • Azure Kubernetes Service (AKS)
      • Azure SQL Database
      • Azure SQL Managed Instances
      • Azure storage account
      • Azure virtual machines
      • Uninstall the Microsoft Azure app
      • Troubleshoot Azure
    • Get Google Cloud data into Observe
      • Configure your GCP project
      • Install the Google Cloud Platform Quickstart app
      • View GCP data in Observe
      • Uninstall the Google Cloud Platform Quickstart app
  • Observe integrations
    • Observe apps
    • Fastly
      • Install the Fastly app
      • View Fastly data in Observe
      • Uninstall the Fastly app
    • GitHub
      • Install the GitHub app
      • View GitHub data in Observe
      • Uninstall the GitHub app
    • GitLab
      • Install the GitLab app
      • View GitLab data in Observe
      • Uninstall the GitLab app
    • MongoDB Atlas
      • Install the MongoDB Atlas app
      • View MongoDB Atlas data in Observe
      • Update the MongoDB Atlas app
      • Uninstall the MongoDB Atlas app
    • MySQL
      • Install the MySQL app
      • View MySQL data in Observe
      • Uninstall the MySQL app
    • Orca Security
      • Install the Orca Security app
      • View Orca Security data in Observe
    • PagerDuty
    • PostgreSQL
      • Install the PostgreSQL app
      • View PostgreSQL data in Observe
      • Uninstall the PostgreSQL app
    • Prometheus metrics
      • Install the Prometheus Metrics app
      • View Prometheus metrics in Observe
    • Prometheus Node Exporter
    • Security Onion
      • Install the Security Onion app
      • View Security Onion data in Observe
    • Service Level Objectives (SLO)
    • Threat Intel (Basic)
      • Install the Threat Intel (Basic) app
      • View Threat Intel (Basic) data in Observe
      • Example: Use unified hosts-domains and URL threatlists
      • Example: Use unified IPv4 threatlists
      • Example: Use unified IPv4 IAAS providers list
  • Custom data ingestion
    • Datastreams
    • Sources
      • GitHub
      • Google Workspace audit logs
      • Jira tickets
      • Webhook
      • Windows servers
      • Zendesk tickets
    • Forwarders
      • Elastic Beats
      • Fluent Bit
      • Fluentd
      • Log4j
      • Logstash
      • Observe Lambda
      • Prometheus
      • Telegraf
    • Endpoints
      • Datadog metrics
      • Elasticsearch
      • HTTP
      • Kinesis
      • OpenTelemetry
      • Prometheus
    • Troubleshoot data ingestion
  • APM instrumentation
    • APM runtime metrics
    • Send Java application data to Observe
    • Send .NET application data to Observe
    • Send Node.js application data to Observe
      • Instrument your Node.js application on a host
      • Instrument your Node.js application in Kubernetes
    • Send Python application data to Observe
    • Send Ruby application data to Observe
    • Send PHP application data to Observe
    • Troubleshoot APM instrumentation
    • Auto-instrumentation with OpenTelemetry Operator in Kubernetes
  • LLM instrumentation
    • Use Node.js (server) instrumentation for LLM observability
    • Use Python instrumentation for LLM observability
    • Other instrumentation for LLM observability

OPAL Reference

  • What is OPAL?
    • OPAL syntax
    • OPAL data types and operators
    • OPAL examples
    • Parse time strings on OPAL
  • OPAL functions and verbs
    • OPAL Functions
      • abs
      • any
      • any_not_null
      • any_null (deprecated)
      • append_item
      • arccos_deg
      • arccos_rad
      • arcsin_deg
      • arcsin_rad
      • arctan_deg
      • arctan_rad
      • array
      • array_agg
      • array_agg_distinct
      • array_contains
      • array_distinct
      • array_length
      • array_max
      • array_min
      • array_null
      • array_pivot (deprecated)
      • array_to_string
      • array_union_agg
      • array_unpivot (deprecated)
      • arrays_overlap
      • asc
      • avg
      • bin_end_time
      • bin_size
      • bin_start_time
      • bool
      • bool_null
      • case
      • ceil
      • check_json
      • coalesce
      • concat_arrays
      • concat_strings
      • contains
      • cos_deg
      • cos_rad
      • count
      • count_distinct
      • count_distinct_exact
      • count_regex_matches
      • countdistinct (deprecated)
      • countdistinctexact (deprecated)
      • decode_base64
      • decode_uri
      • decode_uri_component
      • decodebase64 (deprecated)
      • degrees
      • delta
      • delta_monotonic
      • dense_rank
      • denserank (deprecated)
      • deriv
      • desc
      • detect_browser
      • drop_fields
      • duration
      • duration_hr
      • duration_min
      • duration_ms
      • duration_null
      • duration_sec
      • editdistance
      • embed_sql_params
      • encode_base64
      • encode_uri
      • encode_uri_component
      • encodebase64 (deprecated)
      • ends_with
      • endswith (deprecated)
      • eq
      • ewma
      • exp
      • exponential_histogram_null
      • first
      • first_not_null
      • float64
      • float64_null
      • floor
      • format_time
      • frame
      • frame_exact
      • frame_following
      • frame_preceding
      • from_milliseconds
      • from_nanoseconds
      • from_seconds
      • get_field
      • get_item
      • get_jmespath
      • get_regex
      • get_regex_all
      • group_by
      • groupby (deprecated)
      • gt
      • gte
      • hash
      • hash_agg
      • hash_agg_distinct
      • haversine_distance_km
      • histogram_combine
      • histogram_fraction
      • histogram_null
      • histogram_quantile
      • if
      • if_null
      • ifnull (deprecated)
      • in
      • index_of_item
      • insert_item
      • int64
      • int64_null
      • int64_to_ipv4
      • int_div
      • intersect_arrays
      • ipv4
      • ipv4_address_in_network
      • ipv4_network_int64
      • ipv4_to_int64
      • is_null
      • isnull (deprecated)
      • label
      • lag
      • lag_not_null
      • last
      • last_not_null
      • lead
      • lead_not_null
      • left
      • like
      • ln
      • log
      • lower
      • lpad
      • lt
      • lte
      • ltrim
      • m
      • m_exponential_histogram
      • m_histogram
      • m_object
      • m_tdigest
      • make_array
      • make_array_range
      • make_fields
      • make_object
      • makeobject (deprecated)
      • match_regex
      • match_regex_all (deprecated)
      • max
      • median
      • median_exact
      • medianexact (deprecated)
      • merge_objects
      • metric
      • milliseconds (deprecated)
      • min
      • mod
      • nanoseconds (deprecated)
      • ne
      • now
      • nullsfirst
      • nullslast
      • numeric_null
      • object
      • object_agg
      • object_keys
      • object_null
      • on
      • options
      • order_by
      • orderby (deprecated)
      • otel_exponential_histogram_quantile
      • otel_exponential_histogram_sum
      • otel_histogram_quantile
      • otel_histogram_sum
      • parse_csv
      • parse_duration
      • parse_hex
      • parse_ip
      • parse_isotime
      • parse_json
      • parse_kvs
      • parse_timestamp
      • parse_url
      • parsehex (deprecated)
      • parseip (deprecated)
      • parseisotime (deprecated)
      • parsejson (deprecated)
      • parsekvs (deprecated)
      • parseurl (deprecated)
      • path_exists
      • percentile
      • percentile_cont
      • percentile_disc
      • percentilecont (deprecated)
      • percentiledisc (deprecated)
      • pi
      • pick_fields
      • pivot_array
      • pk
      • position
      • pow
      • prepend_item
      • primary_key
      • primarykey (deprecated)
      • prom_quantile
      • query_end_time
      • query_start_time
      • queryendtime (deprecated)
      • querystarttime (deprecated)
      • radians
      • rank
      • rate
      • regex
      • regex_match (deprecated)
      • regex_replace (deprecated)
      • replace
      • replace_regex
      • right
      • round
      • row_end_time
      • row_endtime (deprecated)
      • row_number
      • row_start_time
      • row_timestamp
      • rownumber (deprecated)
      • rpad
      • rtrim
      • same
      • search
      • seconds (deprecated)
      • sha2
      • sin_deg
      • sin_rad
      • slice_array
      • sort_array
      • split
      • split_part
      • sqrt
      • starts_with
      • startswith (deprecated)
      • stddev
      • strcat (deprecated)
      • string
      • string_agg
      • string_agg_distinct
      • string_concat (deprecated)
      • string_null
      • strlen
      • substring
      • sum
      • tags
      • tan_deg
      • tan_rad
      • tdigest
      • tdigest_agg
      • tdigest_combine
      • tdigest_null
      • tdigest_quantile
      • timestamp_ms
      • timestamp_ns
      • timestamp_null
      • timestamp_s
      • to_days
      • to_hours
      • to_milliseconds
      • to_minutes
      • to_nanoseconds
      • to_seconds
      • to_weeks
      • tokenize
      • tokenize_part
      • topk_agg
      • trim
      • uniform
      • unpivot_array
      • upper
      • valid_for
      • validfor (deprecated)
      • variant_null
      • variant_type_name
      • width_bucket
      • window
      • zipf
    • OPAL Verbs
      • add_key
      • addfk (deprecated)
      • addkey (deprecated)
      • addmetric (deprecated)
      • aggregate
      • align
      • always
      • bottomk
      • bucketize
      • changelog (deprecated)
      • coldrop (deprecated)
      • colenum (deprecated)
      • colimmutable (deprecated)
      • colmake (deprecated)
      • colpick (deprecated)
      • colregex (deprecated)
      • colrename (deprecated)
      • colshow (deprecated)
      • dedup
      • distinct
      • drop_col
      • drop_interface
      • droptime (deprecated)
      • ever
      • exists
      • extract_regex
      • fill
      • filter
      • filter_last
      • fkdrop (deprecated)
      • flatten
      • flatten_all
      • flatten_leaves
      • flatten_single
      • flattenall (deprecated)
      • flattenleaves (deprecated)
      • flattensingle (deprecated)
      • follow
      • follow_not
      • fulljoin
      • histogram
      • interface
      • join
      • leftjoin
      • limit
      • lookup
      • lookup_ip_info
      • make_col
      • make_event
      • make_interval
      • make_metric
      • make_reference
      • make_resource
      • make_session
      • make_table
      • makeresource (deprecated)
      • makesession (deprecated)
      • merge_event (deprecated)
      • merge_events
      • mergeevent (deprecated)
      • never
      • not_exists
      • pick_col
      • pivot
      • reaggregate (deprecated)
      • rename_col
      • rollup
      • set_col_enum
      • set_col_immutable
      • set_col_searchable
      • set_col_visible
      • set_label
      • set_link
      • set_metric
      • set_metric_metadata
      • set_pk
      • set_primary_key
      • set_timestamp
      • set_valid_from
      • set_valid_to
      • setlabel (deprecated)
      • setpk (deprecated)
      • setvf (deprecated)
      • setvt (deprecated)
      • sort
      • statsby
      • surrounding
      • timechart
      • timeshift
      • timestats
      • topk
      • union
      • unpivot
      • unset_all_links
      • unset_keys
      • unset_link
      • unsort
      • update_resource
  • OPAL tutorials
    • Get started with OPAL
    • Shape your data using stages
  • OPAL performance cookbook
    • Use approximate values when feasible
    • Avoid large JSON blobs
    • Cast data columns extracted from JSON
    • Create intermediate Datasets
    • Filter earlier in OPAL scripts
    • Use filter instead of ever
    • Flatten less first
    • Limit worksheet time windows
    • Limit resource time windows
    • Limit valid event time windows
    • Look for hidden columns
    • Use make_events before window functions
    • Mark immutable resource columns
    • Make resources from multiple datasets
    • Prefer join over lookup
    • Prefer lead and lag over first and last
    • Prefer timechart over timestats
    • Limit query time windows
    • Define stricter time filters in queries
    • Reduce columns earlier in OPAL scripts
    • Extract from JSON instead of flattening
    • Type data columns
    • Use interval for ephemeral things
  • OPAL helpful hints
    • How should I aggregate data?
    • How do I find a weighted average?
    • How do I use time window functions?
    • How can I make a standard deviation anomaly detection monitor?
    • How do I find the average of values over time?
    • How do I change a field type?
    • How do I compare time ranges?
    • How do I create an array from existing columns?
    • How do I compute a cumulative count over any interval grouped by multiple fields?
    • Convert to and from time durations
    • Convert to and from timestamps
    • How do I filter by a list of terms?
    • How do I filter out unwanted data?
    • How do I test for multiple values in a dashboard parameter?
    • How do I find the size of a column?
    • How do I format large numbers for readability?
    • How do I measure drift in a metric over time?
    • How do I measure drift in a resource over time?
    • How do I sort dates by time when they are sorted alphabetically?
    • How do I sort digits numerically when they are sorted alphabetically?
    • How do I map fields to each other?
    • How do I pivot a Dataset?
    • How do I unpivot data?
    • Can I use OPAL to rename a Dataset?
    • Best practices for OPAL field extraction
    • Best practices for case statements in OPAL
    • Best practices for field naming in OPAL
    • Best practices for managing the schema interface between Datasets
    • Best practices for using durations in OPAL
    • OPAL case-sensitive filtering with contains
    • OPAL case-sensitive filtering with equals
    • OPAL case-sensitive filtering with match_regex
    • OPAL case sensitive-filtering with tilde and regex
    • OPAL case-sensitive filtering with tilde
    • How do I compare values in OPAL?
    • How do I extract the numeric parts of a message?
    • How do I extract URL parameters?
    • How do I prevent lost columns?
    • How should I rollup aggregated data?
    • How do I search by time?
    • How do I set a column type?
    • How do I split a field?
    • How do I calculate a running standard deviation?
    • What are streamable and unstreamable verbs and functions?

Products

  • Observe AI
    • AI SRE
    • MCP Server
    • o11y AI Help
    • Observe AI important notes and caveats
  • Log management
    • Log Explorer
      • Use live mode in Log Explorer
      • Add new Datasets to Log Explorer
    • Log correlation
    • Unified search syntax
    • Query history
  • APM observability
    • Service management
    • Troubleshoot slow databases and n+1 issues
    • Monitor and track new deployments on your service
    • Associate infrastructure metrics with services
    • Trace Explorer
    • Monitor business applications
    • View logs associated with a trace
    • APM reference
  • LLM observability
    • LLM telemetry reference
  • Snowflake observability
    • Observe for Snowflake components
    • Prepare Observe to receive data from Snowflake
    • Create a virtual warehouse to run Observe for Snowflake
    • Install the Observe for Snowflake app
    • Configure the Observe for Snowflake app
    • Send data from Snowflake to Observe
    • Snowflake data in Observe
    • Use Observe to manage Snowflake
  • Kubernetes observability
    • Install the Observe Agent
    • Kubernetes visibility
    • Kubernetes resource utilization
    • Kubernetes data collection and agent interface
  • Metrics
    • Collect and use metrics
    • Metrics Explorer
    • Add custom metric datasets
    • Add metrics using the Metrics Expression Builder
    • Metrics tutorials
      • Shape metrics
      • Shape aggregated metrics
    • Metrics reference
      • AWS metrics
      • APM metrics
      • Infrastructure metrics (Kubernetes)
      • Infrastructure metrics (hosts)

Platform Capabilities

  • Create and share dashboards
    • Use dashboards to visualize data
    • Generate dashboard reports
    • Create data links
    • Dashboard tutorials
      • Create a single-stat dashboard
  • Create Monitors and alerts
    • Create a threshold monitor
    • Create a count monitor
    • Create a promote monitor
    • Monitor rules and severities
    • Mute a monitor
    • Configure shared actions
      • Customize alert messages
      • Mustache template reference for Slack
      • Sample action for Microsoft Teams
      • Sample action for PagerDuty (v1 Monitors)
      • Sample action for PagerDuty
    • Work with alerts
      • Example using alerts and shared actions
    • Monitor health
    • Negative monitoring
    • Monitor anti-patterns
  • Create and share Worksheets
    • Work with data formats and types
  • Create and share Datasets
  • Explore data
    • Conditional formatting
    • Pivot between data types
    • Data export
      • Configure your S3 bucket to receive data from Observe
      • Create a data export job
  • Correlation tags
  • Resources

Manage Observe

  • Select light and dark mode settings
  • Workspace settings
    • Configure name, icon, and query settings
    • Set default permissions using RBAC
      • Configure RBAC using Terraform
    • Configure connections
    • Instance settings
  • Manage users and access
    • Manage local users
    • Manage local authentication policies
    • Manage groups and members
    • Permission manager
    • Configure single sign-on
      • Configure Microsoft Entra ID SSO
      • Configure ADFS SSO
      • Configure Google Workspace for SAML and SSO
      • Configure Okta for SAML and SSO
      • Configure OneLogin for SSO
      • Configure Ping Identity PingOne for SSO
    • Manage service accounts
    • Track user acvitiy with audit trails
  • Manage credits and usage
    • Acceleration Manager
    • Credit Manager
      • Configure Credit Manager settings using Terraform
      • View your data ingest usage in the License Dashboard
      • View your compute credit usage in the Usage Dashboard
    • Usage attribution
      • Auto-discovered attributes
    • Manage invoices
    • Drop filters
  • Customize the Home page
    • Create and use Favorites
  • Uploaded documents

Knowledge Base

  • Observe Knowledge Base
  • Key terms and concepts
    • Important concepts
    • Key terminology
    • Queries and on-demand acceleration
    • Datasets and time
    • Reference tables
      • Create reference tables using the API
      • Create reference tables using the UI
    • Visualization types
  • Observe deployment regions
  • Keyboard shortcuts
  • Units of measurement
Powered by 
  1. Welcome to Observe
  2. Get help

Observe helpful hints

Find helpful hints to help you do things or find information in the Observe platform.

Updated about 2 months ago


Give documentation feedback
How do I change the name of my Observe Instance?