Creating a metric
Last updated
Last updated
Use metrics to measure and survey over time the characteristics of those elements in your IT infrastructure that interest you the most. Metrics reduce complex queries to a single figure, table, or chart that lets you quickly evaluate the state of key components in your IT ecosystem.
To create metrics in the Finder, you must be a user with granted access to the Finder and have the right to edit system content: categories, services, alerts, and metrics.
To create a new metric in the Finder:
Log in to the Finder as a user with the appropriate permissions.
Select the Metrics section from the accordion on the left-hand side of the main window.
Right-click the header of the Metrics section or the empty area below it.
Select Create new metric from the menu.
Complete the form to define the metric:
Type in the name of the metric.
Optional: Give a short description on the function of the metric.
Fill in each section of the form as described below.
Optional: Click Run as investigation to . This option gives you an instant preview of the results that you can expect from the metric.
Click Save to store permanently the definition of the metric.
Specify the kind of objects used to compute the metric In the Retrieve section:
In the upper-right part of the section, tick the boxes of the platforms to which the metric applies: Windows, Mac OS or Mobile.
Select the type of the objects on which to base the computation of the metric: users, devices, applications, etc.
The choice of a particular kind of object has a logical impact on the grouping options and aggregated values that you can use to define the metric.
The Portal computes the value of each metric once every day, hence the name of the section. For longer periods of time, the Portal combines the values obtained for a metric over several days in the way that you specify.
In the Compute daily section, choose the type of metric that you want to create. Depending on the type of metric, specify how to compute aggregated values for the metric or how to group the retrieved objects when seeing the details of the metric in the Portal.
Choose the type of metric from the following options. The word objects is replaced by the kind of objects that you selected in the Retrieve section:
Count metric
Select the total number of [active] objects to create a metric that counts the selected type of objects. The active keyword, when present, indicates that only those objects that were seen during the last day are taken into account for the calculating the value of the metric for that day. Otherwise, all objects in the full history of the Engine are taken into account. The presence of the active keyword depends on the type of objects being counted:
The active keyword is mandatory for applications, executables, binaries, ports, destinations, domains, and printers.
The active keyword is necessarily absent for packages.
For users and devices, choose to count either all the users or devices or only those that were active the last day.
Quantity metric (only available for device and user objects)
For device objects:
Select the aggregate of active devices to create a metric that computes a single value by combining the values of the chosen aggregate in the retrieved devices.
Choose the particular device activity, score, or output of remote action on which to base the metric from the list. Only outputs that yield a numeric value are available for creating quantity metrics.
If you choose to combine the values of either a score or the output of a remote action, select between active devices or all devices depending on whether you want to limit the retrieved devices to those that were active during the last day or not.
For user objects:
Select the score / EUF opinion scale of all users to create a metric that computes a single value by combining user scores or the answers given by the users to an opinion scale question.
Choose the particular user score or opinion scale question on which to base the metric from the list.
Top metric
Select the top N objects with highest / lowest aggregate to create a metric that keeps a top list of objects with the highest or lowest value of the specified aggregate.
Choose between 10 to 100 (in increments of 10) the number N of objects to display in the top list.
Set either highest or lowest to order the top list of objects by descending or ascending value of the aggregate respectively.
Select the particular aggregate on which to base the top list.
Select the grouping options or aggregate computation when applicable:
For count and quantity metrics, optionally select how the Portal groups the results when you observe the details of the metric. In the Group by list:
Select - none - if you do not need to group the results.
Select a field or a category to group objects by the value of that particular field or category.
Optional: Add another field or category after the keyword and to define a second criterium to group by the objects.
For quantity and top metrics, select how to compute the aggregated values for the metric in Aggregated by.
For quantity metrics, describe how to combine the individual values associated to each one of the retrieved devices. The Portal applies the selected aggregation method to compute the metric for groups of devices (such as those that share a same location in the hierarchy) and for time frames that span longer than one day. Depending on the aggregate (only the options that make sense for the particular aggregate are available), choose among:
sum over all devices and the whole timeframe
maximum value per device per day
average value per device per day
minimum value per device per day
For top metrics, describe how the aggregate is computed individually for each object in the top list for periods of time longer than one day. Depending on the aggregate (only the options that make sense for the particular aggregate are available), choose among:
sum over the whole timeframe
maximum value per day
average value per day
minimum value per day
In the Matching section, specify a set the conditions that the objects in the Retrieve section must meet for taking part in the computation of the metric and, optionally, the hours of the day when the retrieved objects must match those conditions.
To add the conditions:
In the Conditions subsection, click the link Click here to add a new condition. The placeholders for the condition fields show up.
Set the object, activity, or event to which the condition applies.
Set the attribute or category that you want to constraint.
Set the operator for comparison (e.g. is, is not, starts with, etc).
Set the matching value, if you selected an attribute constraint, or the matching keyword, if you selected a category constraint.
Optional: When setting more than one condition, click on Advanced to edit the logical expression that combines the conditions. By default, conditions are combined by a logical AND, so all must be fulfilled.
Optional: Specify a condition on an aggregate value after the and keyword at the bottom of the conditions section. The value of the aggregate is computed for the whole day unless you specify a Between clause (see below).
Any type of metric accepts the values of opinion scale questions and scores as constraints for conditions. In that way, you can create a metric that counts the number of users who gave an answer with value greater than 5 to a particular opinion scale question, for example.
On the other hand, some combinations of metrics, conditions, and additional display fields are incompatible. In particular, count metrics that take into account inactive objects are incompatible with setting a condition on activities or events, or when using a between clause. Under the hood, the computation of these metrics is based on investigations over the full available period in the Engine; therefore, they have similar limitations. An error icon (a small white cross inside a red circle) appears at the selection for counting the total number of objects to indicate the mismatch. There is an exception to this rule: you can set conditions on installations when retrieving the total number of packages. In general, if you add a condition and an error icon appears on its right side, the condition is in conflict with another condition or with one of the chosen attributes to display. By hovering the mouse over the error icon, see the reason for the conflict in a tooltip.
To delete a condition:
Click the trash icon to the right of the condition fields.
For count metrics on active objects, an additional setting specifies how objects are counted when the time frame in the Portal is longer than one day:
Choose either at least one day or the last active day from:For periods longer than one day, count objects that meet conditions on at least one day / the last active day
As a guideline, select at least one day when you want the metric to account for event ocurrences during the period. For instance, a metric that counts the number of devices with hard resets. For a device to be counted, the hard reset can happen any time during the interval. On the other hand, select the last active day for metrics that have an inventory function. For example, a metric that counts the number of devices with two monitors. Indeed, if a device does not have two monitors on the last day of the period, it must not be added to the inventory.
Note that this setting is not available for count metrics that count both active and inactive objects. Indeed, it does not make much sense to see the values of this kind of metrics for periods longer than one day. Widgets based on metrics that count all objects are disabled in the Portal when a period longer than one day is selected.
Optionally, restrict the time of the day to which the computation of the metric applies by ticking the check box and setting the start time and the end time of the computation in the last line of the Matching section:
Between HH:MM and HH:MM.
The contents of the Options section depend on the type of metric that you selected.
For count metrics, the following options are available:
Tick Include ratio to get a percentage in addition to a cardinal number as the displayed value of the count metric in the Portal.
The percentage is computed as the number of objects that match the conditions defined in the metric divided by the number of objects that match another set of conditions.
Define the new set of conditions in the same way as you defined the conditions for the metric with the tools that show up when you tick the Include ratio check box.
Tick Include variation and threshold indicator for the Portal to display changes in the value of the metric with respect to its last value and indicate whether a value increase or decrease is a positive or a negative thing for you. Select one from these three options:
variation indicator only
By default, a green arrow up and a red arrow down are displayed below the statement, meaning that an increase in the value of the metric is a positive thing. For instance, an increase in the number of devices with antivirus is a good thing.
To change the default and indicate that a value increase of the metric is a negative thing, click invert to switch the two arrows. For example, an increase in the number of bluescreens is a bad thing.
variation indicator and 1 threshold
Choose the direction of the variation indicator by clicking invert if appropriate (see first option).
Set the value of the threshold on top of the horizontal arrow. Only when the increase in the value of the metric is higher than the threshold, the indicator changes color (to green if increase is good, to red if it is bad).
If you ticked the option Include ratio, you may want to define the threshold as a ratio:
To the right of the variation message, choose between absolute or ratio values (Include variation message based on absolute / ratio values).
Choose absolute to express the threshold in number of objects, as in the case described above.
Choose ratio to express the threshold in a percenteage related to the ratio value computed for the metric.
If you choose ratio you can ignore the threshold value when grouping results by hierarchy in the Portal if the number of devices in a node of the hierarchy is too small. Tick the option Ignore threshold if there are less than N devices in a hierarchy node and set a value for N.
variation indicator and 2 thresholds
Choose the direction of the variation indicator by clicking invert if appropriate (see first option).
Set the thresholds in the same way as explained in the 1 threshold case. You can also express the thresholds in percentage values if you ticked the Include ratio option. The only difference with the 1 threshold option is the addition of the yellow color:
If the increase in value of the metric is higher than the first threshold, the variation indicator turns yellow.
Only when the increase in the value of the metric is higher than the second threshold, the variation indicator changes color (to green if increase is good, to red if it is bad).
Later, select in the Portal which of these fields to display when seeing the details of the metric.
For quantity metrics, only the options for the variation indicator and thresholds are available. Refer to step 2 of count metrics for instructions. Ignore the sub-options related to ratio, since these are not supported by quantity metrics.
In the case of top metrics, only the option to set additional display fields is available. Refer to step 3 of count metrics for instructions.
RELATED TASKS
RELATED CONCEPT
The procedure to define these conditions in the Conditions part of the definition of a metric is very similar to . Conditions are a set of rules that apply to any item (object, activity, or event) that is related to the objects selected in the Retrieve section:
Set the Additional display fields using the label selector in the same way as you to display in an investigation. The fields selected as criteria to group the results in the Group by list are automatically added as display fields and they cannot be removed.