Setting up notifications to create alerts or reports

(Optional) Specify the time schedule when the notification must be sent.

By default, the schedule is set to every 1 minute.

You can specify the schedule frequency on an hourly, daily, weekly, monthly, or yearly basis and also specify options for the frequency. This means that suppose you select Yearly, you can specify the month, day, and time at which the notification must recur.

Example: When you select Yearly, the options can be set as, "Every January, 5th, at 08 : 15 hours". This selection indicates that you want the notification to be sent on January 5, at 8.15 AM, every year.

Notes:

• The monthly frequency scheduled assumes January to be the starting point. When you create a notification, the next run happens as per the monthly schedule specified in the notification, but considering January as the starting point. Also, on the Notifications page, the next run information (under the Next Run column) is displayed based on the current date and the upcoming schedule considering January as the starting point.
  Example: Suppose you schedule the notification for the second day of every quarter (which means on the second day of January, April, July, and October). And suppose you created the notification on March 15, this means the next run is assumed to be on 2nd April (considering January as the starting point).
• By default, the product can execute approximately 100 notifications every minute with the notification thread pool size set to 10.
  Suppose you have 200 notifications scheduled to execute every minute, then it is recommended that you increase the notification thread pool size to 20. This is necessary to avoid delaying the notification triggers or missing them altogether.
  To increase the notification thread pool size, change the value of the property, notification.threadpool.size in the searchserviceCustomConfig.properties file. For more information about the file path, see Modifying the configuration files.
  This property governs the number of active notifications thread. By default, this property is set to 10.

(Optional) Select one of the time ranges to determine the duration for which the notification must be run.

When you select a saved search, the search duration changes to the time context of the saved search. You can override this by manually selecting the search duration.

Default: Last execution to current execution

Notes: The following capabilities are only applicable while configuring an alert:

• Exclude duplicate events (determined by the Exclude duplicate events feature).
• Search for application names from TrueSight Operations Management (determined by the Application Name feature).

For more information, see Report configuration details. 

The following options are available while configuring an alert:

• Supported external systems: You can select the external systems into which you want to log events.
  For more information about the external systems supported, see Integrating.
  The notification destination name usually starts with "TSIM" or "TSPS".
• SMTP server: You can select the SMTP server that must be used for sending the email alert.
  The options available for configuring an email alert are same as those available for configuring a report.
  The notification destination name usually starts with "Email".
• Script: You can select the option to run a script and provide the script path that must be used for sending the notification.
  The notification destination name is Script: Run a script.
  Note: In the script path, you cannot direct the script output to a file directly. But you can point to some other file containing a script that in turn will redirect the initial script output to the correct file.

While configuring a report, you can select the SMTP server that must be used for sending the email alert.

The notification destination name usually starts with "Email".

Name of the saved search used in the notification.

If you specified multiple conditions (or multiple saved searches) while creating the notification, then the value can be a comma-separated list.

Search string used corresponding to the saved search name.

If you specified multiple conditions (or multiple saved searches) while creating the notification, then the value can be a comma-separated list.

${COUNT}

Number of search results returned by the search query.

If you specified multiple conditions (or multiple saved searches) while creating the notification, then the value can be a comma-separated list.

${STARTTIME}

${ENDTIME}

${URL}

Name of the target hosts from which the data is collected.

Note: If the search query used in the notification is not specific to a particular host, then instead of the actual host name, the macro displays the value as "multiple hosts".

${APPNAME}

Saved search ${QUERYNAME} has result count: ${COUNT} for duration: [${STARTTIME}] to [${ENDTIME}]

<div>Dear User,</div><br/><div>

This email is for information only. Please do not respond to it.</div><br/><div>

The configured notification, ${NAME} containing query, [${QUERYSTR}], with name ${QUERYNAME}, has been triggered. </div><br/><div>

Result Count: ${COUNT}, Launch URL: ${URL}</div><br/><div>

You can login and change the notification. Click <b> Administration > Notifications</b> to navigate to the notifications page.</div>

Saved search ITDA_Log_Monitoring has result count: 3567 for duration: 01/30/2015 11:30:30 GMT to 02/06/2015 11:30:30 GMT

Dear User,

This email is for information only. Please do not respond to it.

The configured notification ITDA_Log_Monitoring_Notification, containing query, COLLECTOR_NAME="ITDA_logs", with name ITDA_Log_Monitoring, has been triggered.

Result Count: 3567, Launch URL: Show in BMC TrueSight IT Data Analytics

You can login and change the notification. Click Administration > Notifications to navigate to the notifications page.