With this feature, you can interpret individual log records by selecting the AI icon located beside each log record. This feature provides concise, easy-to-understand summary of the log’s contents directly beneath the original record, allowing you to comprehend the key event without the need to manually parse complex log data.

Additionally, you have the option to select from AI-suggested follow-up questions or input your own queries to gain further clarification on specific details, such as the request method or the initiating principal. This streamlines the process of log analysis and enables faster, more informed decision-making.

The following image is an example of Single Log Explain:

An example of the history of AI answers and your questions when you click View History:

It enables you to gain high-level understanding of multiple log records by leveraging AI to analyze and summarize the log data displayed in the console. You receive a summary that highlights key patterns, relevant entities, and events across the selected log entries, reducing need for manual inspection of each record.

Additionally, you can further explore the aggregated data by selecting from AI-suggested follow-up questions or entering your own queries, facilitating deeper analysis and faster insights into potential trends or issues within your log data.

This feature is available from the Records with Histogram and Records visualizations.

The following image is an example of Multi-log Explain:

The Cluster Explain feature uses AI to interpret large volumes of clustered log data, surfacing key patterns, potential problems, anomalies, and frequent event combinations. By providing targeted summaries and highlighting relationships, it streamlines identification of operational trends and areas requiring further analysis.

Individual Cluster Message

Click the AI icon on any of the individual Cluster Sample to get a summary of that message. For example:

Multiple Clusters- Potential Issues

Switch to the Potential Issues tab and click the AI icon above the table to get a summary of all of the potential issues. Only up to 500 clusters will be analyzed.

Multiple Clusters- Outliers

Switch to the Outliers tab and click the AI icon above the table to get a summary of the outliers.

Multiple Clusters- Trends

Switch to the Trends tab and click the AI icon above the table. This analyzes each message that is correlated with another and label the correlated messages.

The Chart Explain feature in the Link visualization leverages AI to automatically analyze and summarize the key patterns and characteristics present in the chart. It highlights important groups, identifies anomalies, and points out meaningful differences or trends among data points, such as variations in counts, durations, or distributions.

This helps you to quickly understand and interpret the visualization, condensing the large volume of data processed by the visualization.

Link Chart Explain- Classify

Following is a sample query you can use to try out the AI feature:

* | eval 'Raw Size' = unit('Raw Size', byte) 
  | link Time, 'Log Source' 
  | stats sum('Raw Size') as Size 
  | classify Size, Count, 'Log Source' as 'Log Source Size Analysis'

For details about the link command and more examples of creating link queries, see link.

Click the AI icon below the chart to interact with the chart:

You can click on a specific bubble or a set of bubbles to summarize only that data.

Link Chart Explain- Timestats

Use the following sample query to try out the AI feature:

* | eval 'Raw Size' = unit('Raw Size', byte)
  | link Time, 'Log Source' 
  | timestats name = 'Log Source Trend' sum('Raw Size') as Size by 'Log Source'

For details about the link command and more examples of creating link queries, see link.

You can select specific regions of the chart to explain only the selected region.

Link Chart Explain- Timecluster

Use the following sample query to try out the AI feature:

* | eval 'Raw Size' = unit('Raw Size', byte)
  | link Time, 'Log Source' 
  | timecluster name = 'Log Source Trend' sum('Raw Size') as Size by 'Log Source'

For details about the link command and more examples of creating link queries, see link.