Save changes
When creating events, you may need to create multiple events, hit attributes, or other objects at one time. The Event Manager allows the creation of multiple objects and their testing against an actual session to verify the wanted behavior before saving the changes. By testing before deploying, you ensure that your created objects operates properly on live data.
Saving changes to any object in the Discover Event Manager is a three-step process:
- Save Draft: When you are creating or editing an object,
you first save a draft of the object into the server memory, where
it is stored for the time being. See Saving drafts.
- In the Event Manager, objects that were saved in draft form are highlighted in the display list in each tab. Tabs that contain saved drafts are highlighted in red.
- Save Changes: When you are ready to commit all changes
that were saved in draft mode, you can click the Save Changes button,
which saves all uncommitted changes in each tab to the database. These
changes are immediately available for all Discover servers in the Discover environment. See Committing Changes.
- When saved drafts of objects are committed to the server, the draft indicators are removed.
- The saved changes are applied immediately to hits passing through the Short Term Canister, which may have unexpected implications. See Saved changes and timestamps.
Saving drafts
You can save your work in progress, as needed. If you have unsaved changes, the Save Draft button is red.
- To save your changes in draft form, click Save Draft.
- Events can be tested if they are saved in draft form. You do not
need to commit the changes to the server before testing your events.
See Event Tester.
- If you opened multiple browser tabs in the Event Manager, changes
saved in 1 browser tab may take 10 seconds to be reflected in the
other browser tabs. Note: Unsaved changes in the Event Manager are discarded if you log out of your Portal session or close your web browser.
- If you opened multiple browser tabs in the Event Manager, changes
saved in 1 browser tab may take 10 seconds to be reflected in the
other browser tabs.
Before you commit your changes to the server, you may be informed if changes you made in draft mode conflict with changes made by other users to the same object.
- You may undo changes. See Undoing changes.
Undoing changes
Uncommitted changes are saved in the session cache on the server. They remain in the cache as long as the session is available. The changed object is highlighted in the tab UI, and the Save Changes button is highlighted in red to indicate that there are changes to save.
You may undo the change depending on the following circumstances:
- To undo changes to an item you edited but were not committed to the server, right-click the item and select Revert. The changes are discarded, and the local version in memory reverts to the same version on the server.
- To undo changes to a newly created item, right-click it and select Delete. The new item is discarded.
To undo all unsaved changes in all tabs, click Revert All in the lower-right corner. All local changes in all tabs are discarded.
Committing Changes
After you saved the drafts of one or more objects in the Discover Event Manager, you must commit the changes to the server before the changes to the objects are applied to the captured session data.
When there are unsaved changes, the following button is highlighted in the button toolbar of each tab of the Event Manager.
To commit changes, click Save Changes. The Confirm Changes dialog is displayed.
- The description next to each object is displayed when you select it and then click the object's History button in the toolbar.
- The Change Description at the bottom applies to the saving of all objects. It is displayed when you click the global Change History button.
You may add notes for each item that is being committed, as well as a description of the entire set of changes.
- To commit your changes to the server, click Commit.
- To cancel changes, click Cancel. Note: To revert all changes to the last unsaved state, you must click Revert All. Otherwise, your unsaved changes remain queued for saving.
- Each new Anomaly Detection is created after the new event is committed to the server. No record of a changed or new Anomaly Detection is displayed in the Anomaly Detection tab.
- See Manage Events - Anomaly Detection Tab.
- For more information on auto-creation of Anomaly Detections, see Data management for Anomaly Detections.
Saved changes and timestamps
After you saved changes to any objects through the Discover Event Manager, the changes are immediately applied to any subsequent hits passing through the Short Term Canister.
The Short Term Canister has no awareness of revision history and maintains one set of event and event-related definitions, which is applied to all hits at the time of evaluation.
- If the STC is spooling, when spooled hits are finally evaluated, the event definitions that are applied to them may be significantly different from they were at the time that the hit was created.
- There may be effects on reporting. Some reports bucket data into hourly segments. If you define and save a new event in the 10AM bucket when hits are being spooled, those hits may be evaluated against this new event and reported into earlier time buckets. This evaluation process may result in event counts and other event-related outcomes appearing in report buckets that occurred earlier than the hourly time bucket in which the event was created.
The key to remember is that the current set of events is applied to each hit at the time it is evaluated.