Docs » Add context to metrics using events

Add context to metrics using events 🔗

An event is a periodic occurrence that can be represented in Splunk Observability Cloud outside of the flow of streaming metrics. Events provide context to metric data.

Each event is an instance of an event type. An event type is a reusable event name that groups together events that you want to show as a stream or series, such as code pushes.

By reusing event types, you can add an event type to a chart, then view all events that occurred for that event type. You can also create custom events to record specific actions.

How events are created 🔗

In Splunk Observability Cloud, events are created in several ways.

  • Events are created whenever a detector triggers an alert. A second event is created when the alert clears, is manually resolved, or is stopped due to the detector being edited or deleted.

  • A SessionLog event is created when a user logs into or out of your organization. The SessionLog event notes the action, either “session created” or “session deleted”, and the ID of the user who created the session.

  • A custom event is created when you capture and send an event to Splunk Observability Cloud. For example, you might send a custom “code push” event each time your development team deploys new code, so that you can correlate it with the resource consumption profiles of your infrastructure before and after the event.

View events 🔗

You can add any of the event types described in How events are created to a chart (see View events on a chart) or to an event feed chart on a dashboard.

Recent events are also visible in the Events sidebar, available from the navigation bar when you are viewing any dashboard. Click the Show Sidebar icon, then select the Event Feed tab.

Event Feed sidebar open on the side

The events list in the sidebar indicates the severity of each event and whether it was a trigger event (solid triangle) or clear event (hollow triangle). The sidebar also indicates if an event was a custom event (hollow diamond).

When you hover over an event in the Event Feed sidebar, a vertical line is shown in all the charts at the time the event occurred. The event line makes it easy for you to visualize correlations between metric values and the event.

Event line in all charts

When you click an event in the Event Feed sidebar, you can see details about the event and, for events associated with alerts, an option to open the detector that generated the event. If the event is associated with a currently active alert, you’ll also see an option to resolve the alert.

Note

You can also overlay event markers onto charts on a dashboard.

Create custom events 🔗

Custom events are usually generated through an integration with another service, or through the REST API, and are sent to Splunk Observability Cloud when specific events happen outside Observability Cloud.

You can also create custom events manually, which you can display on charts alongside other events. To create custom events, select New event in the Events sidebar or add custom events while using the Chart Builder. To learn more, see Manually add custom events.

Create a new event from the sidebar 🔗

In the Create Event dialog box, start typing to see a list of event types to choose from. You can also create a new event type by clicking the tooltip.

Create Event dialog box with sample event type

Enter the time and describe the event. You can use Markdown as well as plain text in the description. To save the new custom event and the event type (if you’ve created one) click Create.

Delete custom events 🔗

You can delete only custom events. Events generated by detectors can’t be deleted.

To delete custom events:

  1. Locate and open the custom event:

    • In the Event Feed sidebar, available from within any dashboard, click on a custom event.

    • When viewing or editing an event feed, click on a custom event.

      Event dialog box
  2. Click Mark For Deletion to delete the event.

Note

Marking an event for deletion means that the event might not be deleted immediately. The event will be deleted at some point.