Event Explorer

Event Explorer is the Fault Monitoring feature in Crosswork Assurance. It is a pre-configured dashboard in your Monitoring > Dashboards view of the UI called OTEL Event Explorer (see below). Only Open Telemetry (OTEL) events can be viewed in Event Explorer at this time. Use it when you need to move from a broad time window to the specific alerts, logs, entities, and event payloads behind that window.

How to Enable Event Explorer

Event Explorer requires the otel feature flag. In a cloud deployment, contact your Crosswork Assurance administrator or Cisco support to enable it. In an on-premises deployment, you can enable the feature flag in your Settings view when logged in as the deployment administrator user.

Prerequisites

• Mobility Collector configured and sending OpenTelemetry event data

Verify Events Appear

1. Navigate to Monitoring → Event Explorer
2. Set the time interval to cover the period when events were sent
3. Enable View Alerts and/or View Events
4. Confirm events appear in the timeseries charts and event table

Network operators need to answer questions like "what happened to this device in the past 8 hours?" or "which alerts fired across my network during a maintenance window?" These questions cross alert types, entities, and severity levels. Event Explorer brings all OTEL event data into one page so you can filter, correlate, and inspect without switching between separate views.

How Event Explorer Is Organized

Event Explorer separates events into two branches based on their lifecycle model.

• Alerts (Stateful Events): Alerts follow a lifecycle: they are raised, stay active while the condition persists, and are cleared when the condition resolves. Crosswork Assurance tracks the raised time, cleared time, and duration for each alert instance.
• Events (Stateless Events): Events record that something happened at a specific point in time. There is no lifecycle, no cleared time, and no duration.

Page Layout

• Filter bar: Three filter groups: Source, View Alerts, and View Events.
• Timeseries charts: One chart per enabled branch.
• Distribution panel: A summary chart that breaks events down by category.
• Event table: A paginated table of matching events.
• Details drawer: A sidebar that shows full event details.

How Time Controls Work

Get Started with Event Explorer

Time required: ~10 minutes

Step 1: Open Event Explorer

In the left navigation, click Monitoring → Event Explorer.

The page loads with the View Alerts toggle enabled. You see the alert timeseries chart, the distribution panel, and the event table.

Step 2: Set the Time Range

1. In the application header, locate the interval controls.
2. Choose a duration that covers the period you want to investigate. For example, select 8H to see the past eight hours.
3. Confirm the granularity. Event Explorer defaults to a coarser granularity to prevent excessive data.

Step 3: Read the Timeseries Chart

The alert timeseries chart shows three series:

• Active events (line, right Y-axis) — The number of alerts in an active state at each time bucket
• Raised events (bar, left Y-axis) — The number of alerts raised in each time bucket
• Cleared events (bar, left Y-axis) — The number of alerts cleared in each time bucket

Step 4: Review the Distribution Panel

Below the timeseries chart, the distribution panel summarizes events by category:

• Event type: Alert vs. Event
• Source ID: Which entities generated events
• Event name: Which event types occurred
• Event class: Event classification
• Current state: Active, Cleared (alerts only)
• Severity text: Severity levels across events

Step 5: Select an Event in the Table

1. Scroll to the event table below the distribution panel.
2. Review the columns: Event type, Status, Event name, Source, Severity Text, Raised time, Cleared time, and Duration.
3. Click a row to select it.

A details drawer opens on the right side of the page. The selected row is highlighted in the table.

Step 6: Inspect the Event Details

The details drawer shows:

1. Header: Event name, entity ID, severity tag, and status (Active, Cleared, or Occurred).
2. Timestamps: The raised/occurred time and cleared time (if applicable).
3. Event details: An expandable section with the full event payload, including event name, event class, severity, source ID, observed timestamp, host IP, and body (for example, SNMP trap content).
4. Cleared details: For stateful alerts, a section showing any field values that differ between the raised and cleared events.

Review the Body field for the raw event content that triggered the alert.

Step 7: Compare Related Events

Scroll down in the details drawer to find two expandable sections:

• Same event on this entity: A mini timeseries and table showing other instances of the same event name on the same entity.
• Same event on other entities: A mini timeseries and table showing this event name on different entities.

Expand each section to see if the event is isolated to one entity or widespread.

Filter Events

Use the filter bar to narrow results to specific entities, alert types, or event categories. Each filter group targets a different aspect of your data.

Filter Scope

The Source filter applies to both alerts and events. The View Alerts and View Events filters only affect their respective branches. When neither toggle is enabled, Event Explorer shows an empty state. Enable at least one branch to see data.

Tips:

• Combine filters to isolate specific scenarios (for example, Source ID + Active state + Critical severity)
• Use the distribution panel to discover filter values before applying them
• Filters persist in local storage and restore when you return

Investigate Alerts

Look for raised spikes, active plateaus, and cleared bursts in the timeseries chart. Use the distribution panel to categorize by Source ID, Event name, Current state, and Severity.

What to look for:

• Raised spikes: A sudden increase in new alerts indicates an emerging issue
• Active plateaus: A flat line of active alerts suggests unresolved problems
• Cleared bursts: A spike in cleared alerts may indicate auto-recovery or manual intervention

Compare Raised and Cleared Payloads

Select an alert row and expand Event details to see raised and cleared payloads.

Check Alert Scope

Use Same event on other entities in the details drawer to determine if an alert is isolated or network-wide.

Investigate Events

Enable View Events to see stateless fire-only events. The event timeseries shows occurrence counts. Look for spikes indicating configuration changes or anomalies.

What to look for:

• Event spikes: May indicate configuration changes, restarts, or anomalies
• Recurring patterns: Regular event bursts could signal scheduled jobs or polling intervals
• Correlation with alerts: Events occurring alongside alert spikes may reveal root cause

Use the Distribution Chart

Click any bar to cross-filter. Use Include/Exclude to apply as a filter. Toggle Graph correlation to see relationships between dimensions.

Investigation Playbooks

Which Entities Are Generating the Most Alerts?

1. Enable View Alerts and set the time interval
2. Check the Source ID column in the distribution panel
3. Click the top bar to cross-filter and see alert types

What Happened to a Specific Device?

1. Set the interval to cover the reported period
2. Filter by Source ID
3. Enable both View Alerts and View Events
4. Review timeseries charts and inspect individual events

Are There Any Active Alerts Right Now?

1. Set a recent interval (1H or 4H)
2. Filter Current state → Active
3. Set occurrence mode to Overlaps Interval

What Alerts Fired During a Maintenance Window?

1. Set the interval to cover the maintenance window
2. Set occurrence mode to Within Interval
3. Review the table for raised alerts

Is an Alert Isolated or Network-Wide?

1. Select the alert row
2. Expand Same event on other entities
3. Multiple entities = widespread issue

What Is the Ratio of Active to Cleared Alerts?

Check the Current state column in the distribution panel. A high active ratio suggests unresolved issues.

How Quickly Are Alerts Being Resolved?

Sort the table by Duration. Short durations = fast resolution.

Did a Burst Correlate with a Specific Event Type?

1. Identify the spike in the timeseries chart
2. Narrow the interval to bracket the spike
3. Check Event name in the distribution panel

Are Fire-Only Events Correlating with Alerts?

1. Enable both branches
2. Filter to a specific entity
3. Compare timeseries charts for simultaneous spikes

Customize OTEL Entity Mappings (Advanced)

Most deployments do not need custom mappings. This section is for non-standard event sources.

When You Need Custom Mappings

• Event source uses non-standard resource attribute paths
• Default rules fail and events appear in the dead letter queue

Required Event Fields

Manage Mappings via REST API

View: GET /api/v3/otel-mappings

Update: PUT /api/v3/otel-mappings with _rev and rules[] array.

Mapping Expression Rules

• Tokens must be rooted at resourceLogs.*
• + concatenates values (joined with -)
• Crosswork Assurance uses the first rule where all tokens resolve

Monitoring Mapping Failures

Metric: pca_mapping_failure

Troubleshooting

Check the dead letter queue otel-<tenantId>-dead-letter-queue for rejected events.

Filter Persistence

Event Explorer saves filter selections in local storage. Filters are restored when you return to the page.