SPLK-3002 Investigating Issues with Deep Dives

Investigating Issues with Deep Dives Detailed Explanation

1. What Is a Deep Dive?

Simple Definition

A Deep Dive in ITSI is like a virtual investigation room where you can:

• Explore how different KPIs behaved over time

• See when issues started

• Discover why a service is having problems

It’s a time-based dashboard that shows you trends and relationships between metrics, all in one place.

Think of it like a detective board, where you piece together clues (KPI changes, alerts, logs) to understand the full story behind an incident.

2. Purpose of Deep Dives

Why do we need Deep Dives?

Because problems in IT are often complex:

• One service breaks down because another failed.

• Performance drops without obvious cause.

• Alerts are triggered but the root problem is hidden.

A Deep Dive helps you:

• See multiple KPIs together

• Match KPI behavior with Notable Events

• Understand what happened, when it happened, and why

It’s a powerful tool for solving issues and preventing them from happening again.

3. Key Capabilities of Deep Dives

a. Multi-KPI Time-Series Visualization

You can view several KPIs at once, all displayed as line charts across a common timeline.

For example:

• CPU usage

• Error rate

• Database response time

• Web server latency

This lets you compare trends side-by-side and see how one metric may have influenced another.

Beginner Tip:
If two KPIs change at the same time, they might be connected!

b. Event Timeline

This feature shows when Notable Events occurred, directly on the same timeline as the KPIs.

You can clearly see:

• Did the event happen before or after the spike?

• Was the alert correct or did it miss something?

• What other services were affected?

Why it matters:
Events and KPI trends together give a complete picture, not just one side of the story.

c. Interactive Controls

Deep Dives let you:

• Zoom in on a short time window (e.g., 5 minutes)

• Zoom out to see the bigger picture (e.g., last 6 hours)

• Pan across time to track how things evolved

• Rearrange KPI panels to group related metrics

This helps you focus only on the important timeframes, especially during or around the incident.

d. Drill-Down Capability

You can click on a KPI line or chart point to:

• View the underlying search data

• See related logs or raw events

• Open a dashboard or Notable Event

This means that Deep Dives are not just for viewing—they’re also for investigating in real depth.

4. Use Cases for Deep Dives

Here are some real-world ways teams use Deep Dives:

Troubleshooting Service Degradation

Example: Your website is suddenly slow.
You open a Deep Dive and compare:

• Web server response time

• Database load

• Error rates

You discover that the database query time started increasing 10 minutes earlier—problem found!

Root Cause Analysis of Outages

After a system goes down, you can:

• Look back at all KPIs

• See which metric changed first

• Understand the chain reaction of failures

This helps prevent the same issue in the future.

Post-Incident Review and Documentation

After fixing an issue, you can use the Deep Dive to:

• Show exactly what happened (with graphs)

• Present to your team or management

• Save the Deep Dive as a report or example for later

Detecting Performance Trends or Regressions

You can use Deep Dives proactively, not just after problems.

For example:

• Monitor a new release to see if it causes slowdowns

• Check if performance slowly worsens over days or weeks

• Spot patterns that manual reviews might miss

Summary: What to Remember About Deep Dives

• A Deep Dive is a visual, time-based workspace for analyzing KPI trends and events.

• It helps you understand system behavior over time and find the root causes of problems.

• You can compare many KPIs, view Notable Events, and zoom in on details.

• It’s great for troubleshooting, reviewing, and even preventing incidents.

Investigating Issues with Deep Dives (Additional Content)

1. Deep Dives Can Be Saved as Templates or RCA Artifacts

Why it matters:
Students should understand that Deep Dives are not just real-time investigation tools—they are also valuable for post-incident analysis, reporting, and knowledge sharing.

Suggested Explanation:

Deep Dives in ITSI can be saved and shared in the following ways:

• As Deep Dive Templates: reusable layouts with predefined KPI panels and time windows

• As Root Cause Analysis (RCA) records: snapshots that preserve the full investigative context of an incident

Example use case:

After resolving a major outage, a team saves the Deep Dive to document how the issue unfolded. This can be used in retrospectives, executive briefings, or as training material for new engineers.

This transforms Deep Dives into not just tools for live analysis, but artifacts of operational learning and accountability.

2. Who Uses Deep Dives (Role-Based Use Cases)

Why it matters:
Understanding which roles use Deep Dives helps students connect the tool to real-world job responsibilities.

Suggested Explanation:

Deep Dives are leveraged by various roles within an organization, including:

• SREs (Site Reliability Engineers) – for analyzing service degradation and pinpointing anomalies during incidents.

• NOC (Network Operations Center) Analysts – for correlating real-time events across infrastructure layers.

• Application Owners or DevOps Engineers – to track how app-layer metrics (like error rates or latency) relate to infrastructure KPIs.

By tailoring views to specific KPIs, each role can focus on what matters most to their operational responsibility.

3. Deep Dive vs. Episode Review – Key Differences

Why it matters:
Students often confuse Deep Dives and Episode Review. Clearly outlining their purpose and scope builds conceptual clarity and avoids misuse.

Suggested Explanation:

Feature	Deep Dive	Episode Review
Primary Function	KPI trend analysis over time	Notable Event triage and incident response
Data Source	Time-series KPI panels	Grouped Notable Events
Use Case	Investigating how and why things went wrong	Managing who and what needs to respond
Audience	Engineers, Analysts (deep technical dive)	Incident Managers, On-call Leads

You can think of it this way:

• Episode Review helps you triage the issue

• Deep Dive helps you understand and solve the issue

Summary

Adding these dimensions helps students:

• See how Deep Dives support incident workflows before, during, and after outages

• Connect the tool to specific job roles and responsibilities

• Understand the boundary and synergy between Episode Review (event-based view) and Deep Dives (metric-based view)