Exact-Match Correlation | Germain Documentation

⚙️ Configure Exact-Match Correlation

Exact-Match Correlation combines related data points from multiple sources when they share a common identifier—such as a process ID, thread ID, session ID, correlation ID, username, or server name.

GermainUX uses the matching properties to create a single correlated data point containing information from the original events.

This is useful when multiple sources describe different parts of the same incident, transaction, or business event.

📄 Example: Oracle Siebel CRM Crash

When an Oracle Siebel CRM component crashes, GermainUX may collect related data from several sources:

Source
Windows Event Log
Crash dump
Flight Data Recorder (FDR) file

Exact-Match Correlation can group these records using a shared key—such as the server name and process ID—and generate a single crash event containing the relevant information from all three sources.

🛠 Create a Correlation Scenario

📂 1. Open Correlation Configuration

Go to:

Germain Workspace > Analytics > Correlation

Under Correlation Scenarios, select the Add icon.

📋 2. Define the Scenario

Configure the general properties of the correlation scenario:

Field	Description
Name	Unique name for the scenario. This value can also be used by the KPI that displays the correlated output.
Retention	Length of time GermainUX retains unmatched or partially matched data in the correlation cache. Set this value long enough for all related source events to arrive.
Type	Data-model type used to store the correlated output.
Name Generator	MVEL expression used to populate the `name` field of the correlated data point.

For the Siebel crash example, the retention could be set to one hour if all related crash records are expected to arrive within that period.

🔍 3. Select the Source KPIs

Select the KPIs containing the raw data to correlate.

For the Siebel crash scenario, these may include KPIs containing:

KPI Type
Event Log crash records
Crash dump information
FDR records

Any incoming data point matching one of the selected KPIs is evaluated by the correlation service as part of this scenario.

🔗 4. Define the Correlation Type and Matching Key

Configure how GermainUX determines that incoming records belong to the same event.

Field	Description
Name	Unique identifier for this correlation type.
Key Expression	MVEL expression that generates the matching key from each source record. Records that produce the same key are correlated.
Filters	Optional conditions that determine which source records belong to this correlation type.

For example, a Siebel crash correlation key could combine:

<server name>|<process ID>

image2022-2-9_12-42-50.png?version=1&modificationDate=1644428572454&cacheVersion=1&api=v2&width=340&height=250

The appropriate key depends on the monitored use case. Other examples include:

Example Key
`sessionId`
`correlationId`
`threadId`
`username`
A combination of application, host, and transaction ID

The Key Expression must generate the same value from every source record that should be combined.

image2022-2-9_12-39-50.png?version=1&modificationDate=1644428392666&cacheVersion=1&api=v2&width=275&height=400

⛔ 5. Configure Fields to Exclude

Define which fields should not be copied from the raw records into the correlated output.

Any field not excluded can be transferred to the correlated data point. For example, if system.name is not excluded, the correlated event can retain the system name from its source records.

Exclude fields when they are:

Reason to Exclude
Irrelevant to the correlated result
Duplicated across sources
Likely to conflict
Too large or unnecessary to retain
Sensitive and not required for analysis

💾 6. Save the Scenario

Save the correlation scenario.

GermainUX will begin evaluating incoming data against the selected KPIs, filters, and Key Expressions.

📈 Create a KPI for the Correlated Data

To display and analyze the correlated output:

Go to Germain Workspace > Analytics > KPIs.
Create a KPI.
Set its Fact Class to the output type configured in the correlation scenario.
Set its Name to match the name generated by the scenario.
Save the KPI.
Add the KPI to the appropriate dashboard.

The resulting KPI can be used to monitor, segment, alert on, and investigate the consolidated events.

Configuration Considerations

Before enabling the scenario, confirm that:

Check
Every related source contains the fields required by the Key Expression.
The generated key is specific enough to avoid combining unrelated events.
Retention is long enough to accommodate delays between data sources.
Filters exclude irrelevant source records.
The output KPI matches the scenario’s Fact Class and generated name.

Service: Analytics

Feature Availability: 8.6.0 or later