First, determine which type of knowledge object you want to create:
- Event property: Use event properties to "clean up" your data by transforming an attribute’s names and existing values post-ingest. You can use event properties in queries to summarize, group by and filter on re-usable expression that can be direct references to physical data columns, references to values derived from lookups, or logical expressions evaluating multiple physical columns.
- Flow: Use flows to analyze user actions over time, a sequence of actions, or a sequence of actions over time.
Upcoming versions of Interana 3.0 will include additional knowledge objects.
Creating a context
Use the following steps to begin creating either type of context:
- Click the Knowledge Object icon in the navigation bar.
- Make sure you have the correct dataspace selected, then click Event Properties.
- In the Contexts list, click New Event Property.
- Enter a name for the event property. We recommend creating a descriptive name that will allow you to recognize the function of the context in lists when creating queries or other knowledge objects.
- In the Definition tab, select either Defined Value or Function.
- Optionally, you can add a description in the About tab.
Creating a defined value event property
To create a defined value for an event property, enter a name for the value, then select the value conditions. You can specify multiple values for an event property, and multiple AND/OR conditions for each value.
Click the AND icon to switch between AND and OR.
You must specify at least one value for a defined value event property, and optionally a value to assign if the event property definition does not return any results.
Creating a function event property
To create a function for an event property, specify the actor or context used to evaluate the value, the mathematical operator to perform (add, subtract, multiply, or divide). Then specify whether this is for all events (the default value), or a specific action, event property, or flow that is compared to another action, event property, or flow.