What Happened? analyzes data WISdom has already collected to surface issues that may have affected an instance or database. That data comes from the same 1-minute collection frequency used across WISdom's other monitoring screens (similar to an sp_WhoIsActive snapshot), and can be shown in its full granular form when needed. What Happened? uses this minute-by-minute data to rank what it finds, so you can see exactly what was happening at a specific point in time and what to do about it. It's not a live or simulated replay of activity.
Starting an Analysis
Navigate to Performance › What Happened?
| Field | Description |
|---|---|
| Select Instance | The instance to analyze. |
| Time | The moment you want to investigate. This becomes the end of the window that gets analyzed. |
| Window | How far back from the selected time to analyze: 15 min, 30 min, or 1 hour. A 1 hour window ending at 12:03, for example, analyzes 11:03 to 12:03. |
Click Analyze to run the checks against that window.
At a Glance
Once the analysis finishes, WISdom has evaluated every minute of collected data in the window against its diagnostic checks and summarizes the results at the top of the screen.
The summary bar reads "X of Y minutes had a finding impacting them," where Y is the number of minutes in the window you selected (15, 30, or 60). Next to it, colored counts show how many of those minutes reached each severity level, for example, "25 Medium · 8 High · 5 Critical." These counts are a summary only. They don't filter the timeline or the findings below.
Below the summary bar, the timeline plots every minute in the window as a colored block:
| Color | Severity |
|---|---|
| Teal | Normal |
| Yellow | Medium |
| Coral | High |
| Red | Critical |
A minute's color is a relative signal, not a fixed threshold. It reflects how much diagnostic activity WISdom found during that minute: how many checks fired, and how strong each one's signal was. Normal (teal) means little or nothing was flagged. Medium, High, and Critical climb from there as more checks fire at once or their signals get stronger, with Critical (red) marking the minutes most likely to need your attention.
Think of the color as a rolling severity score for the minute, not the status of a single check. Several lower-severity checks firing at the same time can push a minute's color higher than a minute where only one check fired, even if that one check was itself severe.
Hover over a swatch in the legend below the timeline (Normal, Medium, High, or Critical) to isolate that severity. Minutes at that severity stay lit, and every other minute fades to black. Move the cursor away to restore the full timeline. Only hovering has this effect. Clicking a legend swatch does nothing, and it's not the same interaction as the gray-out legend toggle on Performance Metrics charts.
What We Found
Below At a Glance, What We Found lists every diagnostic check that returned a finding during the window, ranked with the most affected minutes first.
A row of badges across the top, All plus one badge per category present in the results (for example Query & Session, Blocking & Deadlocks, Memory), lets you narrow the list. Only one badge can be active at a time: select a category to show only its findings, or select All to clear the filter.
Each finding card shows its own mini timeline for the window and how many minutes it affected, for example, "23 of 60 min." Click a card to drill into its details (see Drilling into a Finding below).
Diagnostic Checks Panel
Click View all N checks in the top-right corner to open a side panel listing every diagnostic check WISdom evaluated for the window, not just the ones that returned a finding. The panel header shows how many fired versus stayed clear.
Checks that fired are listed first, each with a warning icon and a colored pill showing how many minutes they affected. Checks that stayed clear are listed below, grouped by resource area (Throughput, Contention, CPU, Memory, Storage, Blocking & Deadlocks), each marked with a green Clear pill. Hover over the info icon next to any check for a tooltip defining what it evaluates.
Drilling into a Finding
Click a finding in What We Found to open its detail view. The breadcrumb at the top confirms what you're looking at, for example:
Server: ServerName\INST01 → Range: 11:03 - 12:03 → Rule: Resource-Heavy Query
A mini timeline below the breadcrumb, colored the same way as At a Glance, shows only the window you analyzed. Use Prev and Next to step between minutes; they skip Normal minutes and jump straight to the next minute where this specific rule fired. Normal minutes are never selectable, whether you're stepping with Prev/Next or clicking the timeline directly (see Show all, below).
Every finding has at least a Findings tab and an Activity tab. Most findings also include a Metrics tab showing the specific measurements behind that check, for example, Page Life Expectancy, Checkpoint Pages/sec, and Lazy Writes/sec for Buffer Pool Pressure, or Full Scans/sec and Table Lock Escalations/sec for Blocking and Deadlock. CPU, Memory, and Storage related findings show their own relevant metrics here as well. Blocking findings add a Blocking Details tab, and Deadlock findings add a Deadlock Details tab.
Findings Tab
- Rule name and description — states what the check looks for, for example "A statement that was not observed around the same time in the past 4 weeks has been observed."
- View button — top right. Labeled to match the finding (View Query Details, View Blocking, View Deadlock). Opens the corresponding Performance module page (Blocking or Deadlocks) in a new tab, filtered to the same instance, database, and blocking or deadlock group ID. That page uses its own date range rather than the 15, 30, or 60-minute window you analyzed here, so you can see every occurrence of that specific block or deadlock chain over a longer period.
- KPI cards — Running Sessions, CPU Health, Memory Health, and Storage Health, each with its current value or status and percent change from the previous period.
- Statement box — the SQL statement involved. Labeled Lead Blocker Statement on Blocking findings.
- Supporting Information table — key metrics for the finding, each compared against 4-week history. A metric with no prior history is marked First Seen - No History instead of a point-in-time comparison.
- What to do — three ranked recommendations, each with a short title and a one- or two-sentence explanation of the fix.
Activity Tab
Shows the active processes running at whichever minute you're viewing, matching the timestamp shown above the tabs.
On query and session findings (Resource-Heavy Query, Buffer Pool Pressure, Application Overload, Duplicate Query Storm), a toggle switches between Filter to this finding (only the flagged session) and Show all (every active session during that minute). Switching to Show all also makes the mini timeline clickable, so you can jump straight to any minute that had a finding instead of stepping through with Prev/Next. Normal minutes still can't be selected either way.
Blocking and Deadlock findings don't have that toggle. Their Activity tab always shows every active process for the minute, and Prev/Next are the only way to move between minutes.
Hover over the Active Processes panel to reveal Ask Advisor in the top-right corner, hidden until you do. It opens WISdom Advisor with that activity data.
The grid includes a search icon and a column chooser (the sliders icon) for showing or hiding: Time, Session, Run Time, Instance, Database, Object, Status, Blocked By, Parallel Threads, Wait Category, Wait Type, Wait Time, CPU, IO, Application Host, Login, Program, and SQL Statement. Blocked By is hidden by default; the rest are shown. Use the Rows per page control and the Total rows count at the bottom of the grid to page through results.
Deadlock Details Tab
Available only on Deadlock findings. Two sub-tabs:
| Sub-tab | Columns |
|---|---|
| Processes | Application, Host, Login, Isolation Level, SQL Statement, Input Buffer |
| Resources | Object Name, Index Name, Resource Type, Meta Data Lock Info |
Both include View Deadlock and Download XDL File in the top-right corner. Download XDL File saves the SQL Server deadlock graph (.xdl) for the event, which you can open in SSMS or another XML deadlock graph viewer for node-by-node analysis.
Blocking Details Tab
Available only on Blocking findings. Three sub-tabs:
| Sub-tab | Columns |
|---|---|
| Resources | Lead Blocker, Session ID, CPU, IO, Parallel Threads, Granted Memory, Object, SQL Statement |
| Wait Statistics | Lead Blocker, Session ID, Wait Statistics, Wait Resource, Wait Time, Object, SQL Statement |
| Application | Lead Blocker, Session ID, Application Host, Login, Program, Object, SQL Statement |
Each sub-tab flags the head of the blocking chain with an orange LB badge in the Lead Blocker column, and includes a View Blocking button in the top-right corner. There's no XDL download here since blocking chains don't produce a deadlock graph file.
Metrics Tab
Shown on findings that have specific measurements behind them. Blocking and Deadlock findings plot Full Scans/sec and Table Lock Escalations/sec for the instance across the window; Buffer Pool Pressure plots Page Life Expectancy, Checkpoint Pages/sec, and Lazy Writes/sec. Other findings show whichever metrics are relevant to what they check.
Click Display to open the same Auto-Scale, Host Pressure, and Database Pressure toggles available on Performance Metrics charts. All three are off by default here. Hover over the chart for the exact values at a given minute; the legend below the chart shows the average for the full window.