Example: Retrieve and modify notes in incoming events

To retrieve and modify notes in incoming events, perform the following steps:

1. Define the event selection criteria.
2. Build the policy workflow.

Actions used in the example

• Trigger-If
• Variable
• Enrich
• Function

For more information about actions, see Actions-for-advanced-and-time-based-enrichment.

To define the event selection criteria

1. Select Configuration > Event Policies and click Create.
2. In the Event Selection Criteria, define a condition to select events from the EVENT class that contain the message "testApp".

The following image illustrates how the event selection criteria will look:

To learn how to construct the event selection criteria, see Creating-and-enabling-event-policies.

To build the policy workflow

On the Advanced Enrichment page, perform the following steps to build the policy workflow:

TipYou can hover over an action to view the complete label for the action as shown:

1. Add the Trigger-If action by defining a condition, under the Trigger-If Settings, that checks whether the event status changes.
   
   
   
2. To retrieve a note from an incoming event, add the Variable action to store the result of the GetNote function as the variable value. This function returns the timestamp, author, and content of the note.
   
3. Now, from the note that you retrieved in the previous step, say, you want to fetch only the note content, add the Variable action to store the result of the ListGetElement function as the variable value.
   
   
   
4. Add an Enrich action to enrich the event message and append the note content you retrieved in the previous step to the message.
   
   
   
5. To modify a note by using the policy, add a Function action.
   

Results

The resulting policy workflow retrieves and modifies notes in incoming events as shown in the following image: