Manage Annotations

Annotation is a unique flag that you can attach to the log records. It's composed with a descriptive message and an identifier consisting of a string which may contain spaces and special characters.

The annotations enable you to triage the issues by adding the information about the log records. Here are some of the scenarios where annotations can be useful:

• For collaboration and sharing of found evidence: You can share your findings or research with your team by annotating the log records that form important evidence.
• For record-keeping of root-cause analysis: In case of an issue, the research team conducts a detailed root-cause analysis and identifies the origin of the issue. By tagging the log records that indicate error, the team can record the research result for audit or future use.
• For documenting patterns for future reference: When you notice a behavioral pattern in the analysis, you can annotate the log records by detailing the observations. This can be useful for future reference when you encounter a similar pattern in another application or set of logs.

After adding the annotations to the log records, you can easily retrieve them by using the Annotation Identifier field to filter the log records. See Filter Logs by Annotations.

Add an Annotation to Log Records

The annotation that you add must have a unique identifier and a detailed description of the annotation. The log records that are annotated carry an annotation icon with a count of the number of the annotations added to the log records.

1. In the Log Explorer, view your logs in a records visualization like Records with Histogram or Records.
   • In case you want to annotate a single log record, right click on the log record and click Add Annotation.
   • If you want to annotate multiple log records from your search result, then click More menu on the top right corner of the window, and click Annotate All Search Results.

   The Annotations dialog box opens. Verify that the log record message is visible in the panel.

2. The Annotations dialog box has two tabs, one listing the existing annotations, and the other to create a new annotation.
   • If you want to add a new annotation, click the New tab. Input the following information about the annotation:

     Identifier: This is a unique identifier of the annotation which is available for future use to annotate other log records.

     Message: This is a detailed description of the annotation. For example, this can be your observation of a pattern, an association with an issue, or the details about important log records.

     Click Save.

   • If you want to reuse an existing annotation, then click the Existing tab. Click the Reuse button .
3. Close the Annotations dialog box.

The annotation is added to your selected set of log records. The annotation icon is displayed with each log record that's annotated. The number displayed with the icon is the count of annotations added to the specific log record.

Edit an Annotation

After adding an annotation, you might want to edit it to cover a larger set of log records or to redefine the purpose of the annotation.

1. In the Log Explorer, view your logs in a records visualization like Records with Histogram or Records.
2. Search for the log records that have the specific annotation that you want to edit. See Filter Logs by Annotations.
3. In the table of records, click the annotation icon . The Annotations dialog box opens. Click the Existing tab to see the annotations associated with the log record.
4. Click the Menu icon next to the annotation that you want to edit. Click Edit .
5. Edit the message associated with the annotation. Click Save.

   Verify that the annotation message is updated in the Existing tab of the Annotations dialog box.

   Close the Annotations dialog box.