Slot data types

Slot definitions specify the slot types that are acceptable for processing by assigning data types to the slot.

Slot types

The following table lists the supported data types for creating custom slots.

Datatype	Description
STRING	Sequence of characters, words, or phrases, specified within double quotes. Tips: The maximum limit for this slot type is 32,766 bytes. After the maximum limit is reached, the string is trimmed. You cannot specify single (') or double (") quotation marks for slots that have the String type. If you use the `Within` operator to specify a String event slot, we recommend that you use one of the following example formats to specify the slot details: `Message` Within [CPU utilization,CPU utilization is growing,CPU has issues] `Message` Within ["CPU utilization","CPU utilization is growing","CPU has issues"] Usage of any other format returns an error in the event selection criteria. Default: " " (empty string)
INTEGER	Whole number that does not have a fractional part. Default: 0
STRING_LIST	List of string values. Important: The maximum combined limit for all the elements in the list is 32,766 bytes. After the maximum limit is reached, the string is trimmed. Use the Contains operator in the If, Lookup, and Group selection criteria. Example: `["Tag1","Tag2","Tag3"]` [] is considered as an empty list.
INTEGER_LIST	List of Integer values. Example: `[100,101,102]`
DATE	Epoch value for date. Must be a 13-digit number in the milliseconds format.
FLOAT	Real Numbers that can use a decimal value.
ENUM	List of values used as the range of a particular attribute type. Default: The first ordinal value that corresponds to the lowest numeric value. For a list of out-of-the-box Enum data types, see Out-of-the-box data types. For custom enumerations, see Custom enumerations.

Slot filter conditions

Each data type supports particular filter conditions. These conditions can be specified while creating event policies.

The following table lists the filter conditions available for the slot types that are used for the out-of-the-box slots:

Important

For the event selection criteria, Lookup, Unless, or If actions:

The slot values that you specify with the Contains operator are not case-sensitive.
The slot values that you specify with the Matches and Equals operators are case-sensitive.
For example:
In the case of the Contains operator, Message Contains event and Message Contains EVENT are considered as the same values.
In the case of the Equals or Matches operator, Message Equals event and Message Equals EVENT are considered as two different values.

Slot type Filter conditions for out-of-the-box slots Condition usage examples

String

Equals
Does not equal
Matches
Within
Begins with
Ends with
Contains

Click here to expand...

Equals
Syntax: $EXPR1 `Equals` $EXPR2 Example: Message `Equals` CPU utilization Output: True (Assuming that the incoming event has the message 'CPU utilization')

Does not equal
Syntax: $EXPR1 `Does not equal` $EXPR2 Example: Message `Does not equal` CPU has issues Output: True (Assuming that the incoming event has the message 'CPU utilization')

Matches

Syntax: $EXPR1 Matches $EXPR2

Example: Message Matches ‘% utilization

Output: True (Assuming that the incoming event has the message 'CPU utilization')

The pattern $EXPR2 consists of literal text and value substitutes. Literal text is

matched literally. Space characters in the pattern are matched with any number of

consecutive spaces. Special characters can be specified in the text

with the following escape sequences:

\\	backslash
\s	space (single space)
\n	new line
\r	carriage return
\t	tab
\0 ddd	character code in octal

A substitute is preceded by a % sign, followed by a type indicator. The possible substitutes are:

%%	literal match of %
%d	decimal integer number
%f	floating-point real number
%c	single character
%s	string value

Important:

You can use the Matches operator to specify an empty string by using regular expressions (regex) as follows:

slotName Matches ^\s*$ OR slotName Matches ^(?!\s*$)

The following table shows the regular expression equivalent for an empty string:

Empty string	Regex equivalent
`Location` Equals ""	`Location` Matches ^\s*$
`Location` Does not equal ""	`Location` Matches ^(?!\s*$).+

Within
Syntax: $EXPR1 `Within` $EXPR2 Example: Message `Within` ["CPU utilization","CPU utilization is growing","CPU has issues"] Output: True (Assuming that the incoming event has the message 'CPU has issues)

Begins with
Syntax: $EXPR1 `Begins with` $EXPR2 Example: Message `Begins with` CPU Here, Message equals ‘CPU has issues’ Output: True (Assuming that the incoming event has the message ‘CPU has issues’)

Ends with
Syntax: $EXPR1 `Ends with` $EXPR2 Example: Message `Ends with` CPU Here, Message contains CPU utilization Output: False (Assuming that the incoming event has the message ‘CPU utilization’)

Contains
Syntax: $EXPR1 `Contains` $EXPR2 Example: Message `Contains` CPU utilization Output: True (Assuming that the incoming event has the message ‘CPU utilization is growing’)

Integer

Equals
Does not equal
Less than
Greater than
Greater than or equals
Less than or equals

Click here to expand...

Equals
Syntax: $EXPR1 `Equals` $EXPR2 Example: Repeated `Equals` 10 Output: False (Assuming that the repeat count in the event is set to 12)

Does not equal
Syntax: $EXPR1 `Does not equal` $EXPR2 Example: Repeated `Does not equal` 10 Output: True (Assuming that the repeat count in the event is set to 12)

Less than
Syntax: $EXPR1 `Less than` $EXPR2 Example: Repeated `Less than` 10 Output: False (Assuming that the repeat count in the event is set to 10)

Greater than
Syntax: $EXPR1 `Greater than` $EXPR2 Example: Repeated `Greater than` 10 Output: True (Assuming that the repeat count in the event is set to 12)

Greater than or equals
Syntax: $EXPR1 `Greater than or equals` $EXPR2 Example: Repeated `Greater than or equals` 10 Output: False (Assuming that the repeat count in the event is set to 8)

Less than or equals
Syntax: $EXPR1 `Less than or equals` $EXPR2 Example: Repeated `Less than or equals` `10` Output: True (Assuming that the repeat count in the event is set to 8)

List of string

Equals
Does not equal
Contains
Matches

Click here to expand...

Equals
Syntax: $EXPR1 `Equals` $EXPR2 Example: Tags `Equals` [“CPU utilization is growing”,“CPU utilization”] Output: False (Assuming that tags value in the event has [“CPU utilization”,“CPU utilization is growing”]) Note that the the lists [a,b] and [b,a] are not the same.

Does not equal
Syntax: $EXPR1 `Does not equal` $EXPR2 Example: Tags `Does not equal` [“CPU utilization is growing”,“CPU utilization”] Output: True (Assuming that tags value in the event has [“CPU utilization”,“CPU utilization is growing”])

Contains
Syntax: $EXPR1 `Contains` $EXPR2 Example: Tags `Contains` CPU Output: True (Assuming that tags value in the event has ["CPU utilization","CPU utilization is growing","CPU has issues"])

Matches

Syntax: $EXPR1 Matches $EXPR2

Example: Tags Matches ‘CPU%’

Output: True (Assuming that tags value in the event has [“CPU utilization”,“Utilization is growing”,“Issues”])

The pattern $EXPR2 consists of literal text and value substitutes. Literal text is

matched literally. Space characters in the pattern are matched with any number of

consecutive spaces. Special characters can be specified in the text

with the following escape sequences:

\\	backslash
\s	space (single space)
\n	new line
\r	carriage return
\t	tab
\0 ddd	character code in octal

A substitute is preceded by a % sign, followed by a type indicator. The possible substitutes are:

%%	literal match of %
%d	decimal integer number
%f	floating-point real number
%c	single character
%s	string value

Enum

Equals
Does not equal
Less than
Greater than
Greater than or equals
Less than or equals

Click here to expand...

Equals
Syntax: $EXPR1 `Equals` $EXPR2 Example: Severity `Equals` Minor Output: True (Assuming that the incoming event has the severity as Minor)

Does not equal
Syntax: $EXPR1 `Does not equal` $EXPR2 Example: Severity `Does not equal` Minor Output: True (Assuming that the incoming event has the severity as Major)

Less than
Syntax: $EXPR1 `Less than` $EXPR2 Example: Severity `Less than` Critical Output: True (Assuming that the incoming event has the severity as Minor)

Greater than
Syntax: $EXPR1 `Greater than` $EXPR2 Example: Severity `Greater than` Minor Output: True (Assuming that the incoming event has the severity as Critical)

Greater than or equals
Syntax: $EXPR1 `Greater than or equals` $EXPR2 Example: Severity `Greater than or equals` Minor Output: True (Assuming that the incoming event has the severity as Minor)

Less than or equals
Syntax: $EXPR1 `Less than or equals` $EXPR2 Example: Severity `Less than or equals` Major Output: True (Assuming that the incoming event has the severity as Minor)

Date (Epoch milliseconds)

Equals
Does not equal
Less than
Greater than
Greater than or equals
Less than or equals

Click here to expand...

Equals
Syntax: $EXPR1 `Equals` $EXPR2 Example: Arrived Equals 06/06/2022 Output: True (Assuming that the value of Arrived in the incoming event is 06/06/2022. The value of the date is considered in milliseconds.)

Does not equal
Syntax: $EXPR1 `Does not equal` $EXPR2 Example: Arrived Does not equal 06/06/2022 Output: True (Assuming that the value of Arrived in the incoming event is 06/07/2022. The value of the date is considered in milliseconds.)

Less than
Syntax: $EXPR1 `Less than` $EXPR2 Example: Arrived Less than 06/07/2022 Output: True (Assuming that the value of Arrived in the incoming event is 06/06/2022. The value of the date is considered in milliseconds.)

Greater than
Syntax: $EXPR1 `Greater than` $EXPR2 Example: Arrived Greater than 06/07/2022 Output: False (Assuming that the value of Arrived in the incoming event is 06/06/2022. The value of the date is considered in milliseconds.)

Greater than or equals
Syntax: $EXPR1 `Greater than or equals` $EXPR2 Example: Arrived Greater than or equals 06/06/2022 Output: True (Assuming that the value of Arrived in the incoming event is 06/07/2022. The value of the date is considered in milliseconds.)

Less than or equals
Syntax: $EXPR1 `Less than or equals` $EXPR2 Example: Arrived Less than or equals 06/07/2022 Output: True (Assuming that the value of Arrived in the incoming event is 06/06/2022. The value of the date is considered in milliseconds.)

Enumeration data types

Enumeration (or Enum) data types are related to integral constants that represent special values within a module.

Slot enumerations specify acceptable values for a particular slot. The following table lists the out-of-the-box enumerations. Out-of-the-box enums cannot be edited or deleted.

Enum data type	Description
SEVERITY	Lists the possible severity values for an event slot: Possible values: CRITICAL, MAJOR, MINOR, WARNING, INFO, OK, UNKNOWN
PRIORITY	Lists the possible priority values for an event. Priority 5 indicates the lowest priority and conversely Priority 1 is the highest priority. Possible values: PRIORITY_1,PRIORITY_2,PRIORITY_3,PRIORITY_4,PRIORITY_5
STATUS	Lists the possible status values for an event slot. Possible values: OPEN, ACK, ASSIGNED,CLOSED,BLACKOUT
CATEGORY	Lists the possible category values for an event slot. Possible values: SLA_MANAGEMENT, CAPACITY_MANAGEMENT, SERVICE_CONTINUITY_MANAGEMENT, AVAILABILITY_MANAGEMENT, INCIDENT_MANAGEMENT, CONFIGURATION_MANAGEMENT, RELEASE_MANAGEMENT, PROBLEM_MANAGEMENT, CHANGE_MANAGEMENT, OPERATIONS_MANAGEMENT, SECURITY_MANAGEMENT, FINANCIAL_MANAGEMENT, SERVICE_DESK_MANAGEMENT
SUB_CATEGORY	Lists the possible subcategory values for an event slot. Possible values: USER_TRANSACTIONS, SYSTEM,NETWORK, DATABASE, APPLICATION, OTHER
BOOLEAN	Lists the boolean values for an event slot. Possible values: FALSE, TRUE
INCIDENT_TYPE	Lists the type of incident for an event slot. This incident is created on BMC Helix IT Service Management . Possible values: UNKNOWN, CAUSAL, IMPACTED

Custom enumerations

Define a custom list of values for Enum data type event slots of the out-of-the-box event classes (except the Event base class) and custom classes. Specify custom enumerations in the event selection criteria. Additionally, specify custom enumerations in the If, Enrich, Variable, Function, Lookup, Trigger-if, and Unless actions on the enrichment policy workflow. Use event operators that are supported for out-of-the-box enumerations with custom enumerations for filtering event slots. For more information, see Out-of-the-box event operators.

You can manage custom enumerations by using APIs. For more information, see Custom enumeration management endpoints in the REST API.

For example, you want to select events based on the device or application status. You could define the following custom list of values to indicate the device or application status and use this custom enumeration to process events:

Device status enumeration

ROUTER_STATE = [
       {"value": "UP", "index": 0, "label": "Up"},

       {"value": "DOWN", "index": 1, "label": "Down"},

       {"value": "ADMIN_DOWN", "index": 2, "label": "Administratively Down"}
       ]

Application status enumeration

APPLICATION_STATE= [
       {"value": "UNKNOWN", "index": 0, "label": "Unknown"},
 
       {"value": "STANDBY", "index": 1, "label": "Standby"},
 
       {"value": "PAUSED", "index": 2, "label": "Paused"},
	   
	   {"value": "UNAVAILABLE", "index": 3, "label": "Unavailable"},
 
       {"value": "STARTED", "index": 4, "label": "Started"},
 
       {"value": "ACTIVE", "index": 5, "label": "Active"},
	   
	   {"value": "STOPPED", "index": 6, "label": "Stopped"}
       ]

To use this enumeration as a class attribute while creating event classes. see the POST /events/classes endpoint on the Event management endpoints in the REST API page.

To understand a use case for custom enumerations, see Example: Enrich events according to the device status.

Slot data types

Slot filter conditions

Enumeration data types

Custom enumerations

Comments