Analyze log lines around an anomaly

task brazil Updated Sep 10, 2026 1 min read hla-op-surrounding-logs-view-sow.md

Raw file servicenow.com

Review the log lines around an anomaly to help you identify the root cause of a Log Analytics alert.

Before you begin

For background information, see Review logs surrounding an anomaly.

Role required: evt_mgmt_operator or evt_mgmt_admin

Procedure

In the Service Operations Workspace, open a Log Analytics alert.
Select the Surrounding logs tab and review the information.

The tab displays the list of log lines that were generated one minute before and one second after the Log Analytics alert. For an explanation of the information on the tab, see Surrounding logs tab fields.
View a different time span of the log lines using one of the following methods:
- Update the time range relative to the alert to a predefined time range in the Select range list.
- Specify a Start time or End time using the time picker.
View the anomalous log data graphically as a function of time by selecting Log viewer.

Parent Topic:Review logs surrounding an anomaly

Keywords surrounding logsanomaly analysislog timeline analysisroot cause analysishealth log analyticslog anomaly investigationlog vieweranomaly timelinelog investigationalert investigationlog data analysisanomaly root causetroubleshooting logssystem fault diagnosis

43 lines · 2.4 KB Wrap lines

---
title: Analyze log lines around an anomaly
description: Review the log lines around an anomaly to help you identify the root cause of a Log Analytics alert.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/it-operations-management/health-log-analytics/hla-op-surrounding-logs-view-sow.html
release: brazil
product: Health Log Analytics
classification: health-log-analytics
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
keywords: [surrounding logs, anomaly analysis, log timeline analysis, root cause analysis, health log analytics, log anomaly investigation, log viewer, anomaly timeline, log investigation, alert investigation, log data analysis, anomaly root cause, troubleshooting logs, system fault diagnosis]
breadcrumb: [Review logs surrounding the anomaly, Analyzing and resolving alerts, Health Log Analytics, ITOM AIOps, IT Operations Management]
---

# Analyze log lines around an anomaly

Review the log lines around an anomaly to help you identify the root cause of a Log Analytics alert.

## Before you begin

For background information, see [Review logs surrounding an anomaly](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/health-log-analytics/hla-op-surrounding-logs-view-concept.md).

Role required: evt\_mgmt\_operator or evt\_mgmt\_admin

## Procedure

1. In the Service Operations Workspace, open a Log Analytics alert.

2. Select the **Surrounding logs** tab and review the information.

The tab displays the list of log lines that were generated one minute before and one second after the Log Analytics alert. For an explanation of the information on the tab, see [Surrounding logs tab fields](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/health-log-analytics/hla-surrounding-logs-tab.md).

3. View a different time span of the log lines using one of the following methods:

- Update the time range relative to the alert to a predefined time range in the **Select range** list.
- Specify a **Start time** or **End time** using the time picker.
4. View the anomalous log data graphically as a function of time by selecting **Log viewer**.

**Parent Topic:**[Review logs surrounding an anomaly](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/it-operations-management/health-log-analytics/hla-op-surrounding-logs-view-concept.md)