Filtering events

To prioritize and quickly take action on events, you can use the various built-in filters to filter events on the Monitoring > Events page. You can filter events with quick filters, time filters, or with global search.

Related topic

Event-deduplication-and-suppression-for-filtering-unwanted-events


Using the global search

On the Monitoring > Events page, click the search box at the top-right of the screen. You can perform searches based on host name and message.

The global search takes precedence over any filters that you use. For example, if you use the global search option global_search.png, the quick filter panel disappears, and you can see the results of the global search on the Events page.

global_search_events.png



Using quick filters

The quick filters at the top of the page enable you to filter events based on status and severity.

The following illustration shows the quick filters that you can use on the Events page:

Events Quick Filters.png

  1. Event status row: Select the event status that you want to view. You can select more than one event status. To consider all events, irrespective of status, clear all the event status boxes.
    The following filters are available by default:
    • Open
    • Acknowledge
    • Assigned
    • Blackout
  2. Event severity row: Select the event severity that you want to view. You can select more than one event severity. To consider all events, irrespective of severity, clear all the event severity boxes.
    The following filters are available by default:
    • Critical
    • Major
    • Minor
    • Warning
    • Information

The number of events displayed in the event severity row depends on the selected event status. When you change the event status selection, the number of events displayed in the event severity row is automatically updated.

How do the event status and severity filters work?

The event status and event severity filters work in conjunction. Only the events that meet both the filter criteria are displayed.

For example, if you select Open and Assigned from the event status filter and select Critical and Major from the event severity filter, the result displays the list of events with open or assigned status with critical or major severity.


Saving or restoring your quick filters preference

You can save or restore your quick filters preference to use it every time that you use the Events page.

  1. Select the desired event status and event severity.
  2. From the Events action menu, select Save As Preference.
  3. To restore the default quick filters, select Restore Default Filters.


Using time filters

Use the time filter to filter events based on the time of their occurrence.

The following illustration displays the available time filters:

events_time_filter.png

Filter events based on the following time periods:

  • Predefined time periods: You can select a time period from the list. Events that have occurred during the selected time period are displayed.
  • Custom time period: You can create a custom time period for which to filter events.

Create a custom time period to filter events. To do this, perform the following actions on the Monitoring > Events page:

  1. From the time filter menu, select Define Period.
  2. Choose the start and end date and time.
  3. Select Apply.

  4. Select the custom time period that now appears in the time filter menu.

    Note

    Custom time periods are applied only to the current user session on the BMC Helix Operations Management console.


Using advanced filters

Use advanced filters to filter events based on multiple criteria other than the event status. The following scenario explains how to use advanced filters.

Example

Sarah is a system administrator at Apex Global, which uses BMC Helix Operations Management for their monitoring needs. Sarah wants to check which PATROL Agents are disconnected. She knows that she can search for events about the disconnected PATROL Agents. She wants to filter all events that contain the word "disconnected" in the message so she can quickly view the disconnected PATROL Agents. Sarah also wants to save the filter so she can filter for disconnected Agents again. How can Sarah achieve these goals?

Sarah uses advanced event filters to view events that she specifies and then saves the filter.

The following video (1:46) explains how to use an advanced event filer.

icon-play@2x.png  https://youtu.be/_g3uUK5ZS4E

You can perform the following actions on the advanced filters that you create:

  • Save
  • Update
  • Delete
  • Save the filters as a preference

You can also view and apply the filters that other users have created. However, you cannot modify or delete them.

Important

The global search takes precedence over advanced filters. If you use the global search option <image>, the Advanced filter option disappears, and you can see the results of the global search on the Events page.

Creating advanced filters

  1. Navigate to the Monitoring > Events page, and click Advanced Filter adv_filter_icon.png.

  2. In the Selection criteria field, select the criteria to filter the events.
    You can select multiple criteria at a time. For example, select the following criteria to filter alarm events that have testobject as the object type:
    (Class Equals Alarm) AND (Object Matches testobject)

    Important

    • To search for custom slots in an event, make sure that the custom slot value is less than 256 characters. If the slot value exceeds 256 characters, the event is not listed in the event search if you use advanced filters or global search.
    • If you have customized the display name of custom classes or event slots of custom classes by using APIs, view and select the display name of the custom classes or custom event slots in the criteria.
  3. Click Save to save the filter.
  4. Click Apply filters to apply the filter to events.
  5. (Optional) If you want to save the filter, perform the following actions:
    1. Click Save .
    2. Provide a unique name for the advanced filter and save it.

Updating advanced filters

  1. Navigate to Monitoring > Events page, and click Advanced Filter adv_filter_icon.png.
  2. Click the Saved tab.
  3. In the Created by me area, click the Edit icon against the filter that you want to update. 
  4. Make your changes and save the filter.

Important

If the advanced filter does not contain a class as a selection criterion, the EVENT class is considered as the default class. You cannot select any other class.

Deleting advanced filters

  1. Navigate to the Monitoring > Events page, and click Advanced Filter adv_filter_icon.png.
  2. Click the Saved tab.
  3. In the Created by me area, click Delete against the filter that you want to delete. 
  4. Provide your confirmation and delete the filter.

Saving an advanced filter as a preference

When you save an advanced filter as a preference, the filter is applied to events by default every time you open the Events page.

  1. Apply a filter.
  2. Click the Events action menu action_menu.pngand click Save As Preference.
    events_action_menu_with_pref.png

Removing an advanced filter as a preference

  1. Navigate to the Monitoring > Events page, and clear the applied advanced filter.
    clear_applied_filter.png
  2. Click the Events action menu action_menu.pngand click Save As Preference.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*