Filtering events

For advanced filtering options like viewing events from specific devices, you can create custom filters.

Creating custom filters

Applying custom filters

Performing operations on custom filters

To create custom filters

1. From the Events action menu, select Create Custom Filter .
   
2. Select one or more event status and severity. 
   Filtering is disabled if you do not select any event status or severity, and events with any status or severity are considered.

3. Select any one of the applications, groups, or devices category. Use the drop-down box of the selected category to select one or more items.

   Note

   The applications, groups, and devices categories are populated based on your permissions. For more information, see Creating roles.

4. (Optional) To add advanced filtering options, select the Add Advanced Filter check box. See Advanced filtering for more information.

5. Click Apply to apply the custom filter.

   Note

   The custom filter is applied but not saved. To make changes to the custom filter before saving it, select Create Custom Filter .

   Ensure to save the custom filter before you navigate to a different page or restore default filters.

6. From the Events action menu, select Save As New Filter to save the custom filter.
7. Enter the custom filter name and click OK.

Advanced filtering

1. From the Class list, select a class.
   The sub-classes for the selected class are automatically selected.
2. To filter events according to one or more event attributes, specify the following information for each attribute:
   1. (Optional) Select a left parenthesis or a NOT condition.

   2. Select an event attribute.

      Note

      For some event attributes, the internal names are displayed. For example, error_message, error_val.

      If you want to view the display name for an event attribute, you need to add the attribute to the en.json file:

      1. Open the en.json file from the  <installationDirectory>\TrueSightPServer\truesightpserver\modules\tomcat\webapps\infraApp\WEB-INF\classes folder.

      2. Go to the end of the file and add a comma after the last line of code and press ENTER.

      3. Add information for the event attribute in the following format: eventView.slot.<CLASS_NAME>.<SLOT_NAME>=<SLOT_DISPLAY_NAME>
where, CLASS_NAME = Event class name of your event attribute (slot)

      SLOT_NAME = Internal name of the event attribute that is currently displayed

      SLOT_DISPLAY_NAME = Name of the event attribute that you want to replace the internal name with

      4. Repeat the earlier step for all the event attributes that you want to add.

      5. Restart the Presentation Server.

   3. Select a comparison operator. 
   4. Enter a value against which you want the filter to compare.
   5. (Optional) Select a right parenthesis.

   6. To add another filter condition (event attribute), click

   7. Select a logical operator, AND or OR.
   8. Repeat step a through step g to add as many filter conditions as you want.
   9. To remove a filter condition, click  in the corresponding filter condition row.

Comparison operators

To apply custom filters

1. From the Events action menu, select View Saved Filters .
   The list of saved custom filters is displayed.

2. Select a custom filter from the list.

To perform operations on custom filters

1. From the Events action menu, select View Saved Filters .
   The list of saved custom filters is displayed.
2. From the action menu for the custom filter, you can edit, rename, or delete the custom filter.