Link Visualization

Link lets you perform advanced analysis of log records by combining individual log records from across log sources into groups, based on the fields you’ve selected for linking. You can analyze the groups by using the same fields as the ones you used for linking or additional fields for observing unusual patterns to detect anomalies.

Link command can be used for a variety of use-cases. For example, individual log records from business applications can be linked to synthesize business transactions. Groups can also be used to synthesize user sessions from web access logs. Once these linked records have been generated, they can be analyzed for anomalous behavior. Some examples of this anomalous behavior can include:

  • Business Transactions that are taking unusually long to execute or are failing.

  • User sessions that are downloading large amounts of data than normal.


To use the Link feature, users need to have a good understanding of their log sources. The Link feature relies on a field or a set of fields that are used to combine individual log records. To generate meaningful associations of log records, it is important to know the relevant fields that can be used for linking the log records.
To understand the application of the Link feature in performing advanced analytics with an example, see Perform Advanced Analytics with Link, Examples of Semantic Clustering, and Examples of Tile Layout in Link. These are the features highlighted in the use cases:
  • Link Trend

  • Generating charts with virtual fields

  • Using SQL statement as a field of analysis

  • Generating charts for multiple fields and their values

  • Second level aggregation

  • Time analysis

  • Navigation functions

  • Using currency symbol in groups table and charts

  • Using tiles in link to show summary data