| Whole numbers that range from -2^63-1 to 2^63. Use the long data type in the following scenarios: - To specify slots in both the out-the-box and custom classes that are too large to fit in the integer data type.
- To specify slots in the event selection criteria and the If and Lookup actions in advanced enrichment policies.
Default: 0
))} Each data type supports particular filter conditions. These conditions can be specified while creating event policies. The following table lists the filter conditions available for the slot types that are used for the out-of-the-box slots: WarningImportant For the event selection criteria, Lookup, Unless, or If actions: - The slot values that you specify with the Contains operator are case-insensitive.
- The slot values that you specify with the Matches and Equals operators are case-sensitive.
For example:
For the Contains operator, Message Contains event and Message Contains EVENT are considered as the same values.
For the Equals or Matches operator, Message Equals event and Message Equals EVENT are considered as two different values. - The slot values that you specify with the Matches operator cannot exceed 1000 characters.
| Filter conditions for out-of-the-box slots | |
|---|
| - Equals
- Does not equal
- Matches
- Within
- Begins with
- Ends with
- Contains
! (NOT) WarningImportant The Not condition cannot be used with the Class attribute.
|
Click here to expand...
|
|---|
Syntax: $EXPR1 Equals $EXPR2
Example: Message Equals CPU utilization
Output: True (Assuming that the incoming event has the message 'CPU utilization') |
|
|---|
Syntax: $EXPR1 Does not equal $EXPR2
Example: Message Does not equal CPU has issues
Output: True (Assuming that the incoming event has the message 'CPU utilization') |
|
|---|
Syntax: $EXPR1 Matches $EXPR2
Example: Message Matches ‘% utilization
Output: True (Assuming that the incoming event has the message 'CPU utilization') The pattern $EXPR2 consists of literal text and value substitutes. Literal text is matched literally. Space characters in the pattern are matched with any number of consecutive spaces. Special characters can be specified in the text with the following escape sequences: A substitute is preceded by a % sign, followed by a type indicator. The possible substitutes are: | | | | | floating-point real number | | | | |
Important: You can use the Matches operator to specify an empty string by using regular expressions (regex) as follows: slotName Matches ^\s*$ OR slotName Matches ^(?!\s*$) The following table shows the regular expression equivalent for an empty string: | |
|---|
| | Location Does not equal "" | Location Matches ^(?!\s*$).+ |
|
|
|---|
Syntax: $EXPR1 Within $EXPR2
Example: Message Within ["CPU utilization","CPU utilization is growing","CPU has issues"]
Output: True (Assuming that the incoming event has the message 'CPU has issues) |
|
|---|
Syntax: $EXPR1 Begins with $EXPR2
Example: Message Begins with CPU
Here, Message equals ‘CPU has issues’
Output: True (Assuming that the incoming event has the message ‘CPU has issues’) |
|
|---|
Syntax: $EXPR1 Ends with $EXPR2
Example: Message Ends with CPU
Here, Message contains CPU utilization
Output: False (Assuming that the incoming event has the message ‘CPU utilization’) |
|
|---|
Syntax: $EXPR1 Contains $EXPR2
Example: Message Contains CPU utilization
Output: True (Assuming that the incoming event has the message ‘CPU utilization is growing’) |
|
|---|
Syntax: ! ($EXPR1 Contains $EXPR2)
Example: ! (Message Contains CPU utilization)
Output: False (Assuming that the incoming event has the message ‘CPU utilization is growing’) |
| | - Equals
- Does not equal
- Less than
- Greater than
- Greater than or equals
- Less than or equals
|
Click here to expand...
|
|---|
Syntax: $EXPR1 Equals $EXPR2
Example: Repeated Equals 10
Output: False (Assuming that the repeat count in the event is set to 12) |
|
|---|
Syntax: $EXPR1 Does not equal $EXPR2
Example: Repeated Does not equal 10
Output: True (Assuming that the repeat count in the event is set to 12) |
|
|---|
Syntax: $EXPR1 Less than $EXPR2
Example: Repeated Less than 10
Output: False (Assuming that the repeat count in the event is set to 10) |
|
|---|
Syntax: $EXPR1 Greater than $EXPR2
Example: Repeated Greater than 10
Output: True (Assuming that the repeat count in the event is set to 12) |
|
|---|
Syntax: $EXPR1 Greater than or equals $EXPR2
Example: Repeated Greater than or equals 10
Output: False (Assuming that the repeat count in the event is set to 8) |
|
|---|
Syntax: $EXPR1 Less than or equals $EXPR2
Example: Repeated Less than or equals 10
Output: True (Assuming that the repeat count in the event is set to 8) |
| | - Equals
- Does not equal
- Contains
|
Click here to expand...
|
|---|
Syntax: $EXPR1 Equals $EXPR2
Example: Tags Equals [“CPU utilization is growing”,“CPU utilization”]
Output: False (Assuming that tags value in the event has [“CPU utilization”,“CPU utilization is growing”])
Note that the the lists [a,b] and [b,a] are not the same. |
|
|---|
Syntax: $EXPR1 Does not equal $EXPR2
Example: Tags Does not equal [“CPU utilization is growing”,“CPU utilization”]
Output: True (Assuming that tags value in the event has [“CPU utilization”,“CPU utilization is growing”]) |
|
|---|
Syntax: $EXPR1 Contains $EXPR2
Example: Tags Contains CPU
Output: True (Assuming that tags value in the event has ["CPU utilization","CPU utilization is growing","CPU has issues"]) |
| | - Equals
- Does not equal
- Less than
- Greater than
- Greater than or equals
- Less than or equals
|
Click here to expand...
|
|---|
Syntax: $EXPR1 Equals $EXPR2
Example: Severity Equals Minor
Output: True (Assuming that the incoming event has the severity as Minor) |
|
|---|
Syntax: $EXPR1 Does not equal $EXPR2
Example: Severity Does not equal Minor
Output: True (Assuming that the incoming event has the severity as Major) |
|
|---|
Syntax: $EXPR1 Less than $EXPR2
Example: Severity Less than Critical
Output: True (Assuming that the incoming event has the severity as Minor) |
|
|---|
Syntax: $EXPR1 Greater than $EXPR2
Example: Severity Greater than Minor
Output: True (Assuming that the incoming event has the severity as Critical) |
|
|---|
Syntax: $EXPR1 Greater than or equals $EXPR2
Example: Severity Greater than or equals Minor
Output: True (Assuming that the incoming event has the severity as Minor) |
|
|---|
Syntax: $EXPR1 Less than or equals $EXPR2
Example: Severity Less than or equals Major
Output: True (Assuming that the incoming event has the severity as Minor) |
| Date (Epoch milliseconds) | - Equals
- Does not equal
- Less than
- Greater than
- Greater than or equals
- Less than or equals
|
Click here to expand...
|
|---|
Syntax: $EXPR1 Equals $EXPR2
Example: Arrived Equals 06/06/2022
Output: True (Assuming that the value of Arrived in the incoming event is 06/06/2022. The value of the date is considered in milliseconds.) |
|
|---|
Syntax: $EXPR1 Does not equal $EXPR2
Example: Arrived Does not equal 06/06/2022
Output: True (Assuming that the value of Arrived in the incoming event is 06/07/2022. The value of the date is considered in milliseconds.) |
|
|---|
Syntax: $EXPR1 Less than $EXPR2
Example: Arrived Less than 06/07/2022
Output: True (Assuming that the value of Arrived in the incoming event is 06/06/2022. The value of the date is considered in milliseconds.) |
|
|---|
Syntax: $EXPR1 Greater than $EXPR2
Example: Arrived Greater than 06/07/2022
Output: False (Assuming that the value of Arrived in the incoming event is 06/06/2022. The value of the date is considered in milliseconds.) |
|
|---|
Syntax: $EXPR1 Greater than or equals $EXPR2
Example: Arrived Greater than or equals 06/06/2022
Output: True (Assuming that the value of Arrived in the incoming event is 06/07/2022. The value of the date is considered in milliseconds.) |
|
|---|
Syntax: $EXPR1 Less than or equals $EXPR2
Example: Arrived Less than or equals 06/07/2022
Output: True (Assuming that the value of Arrived in the incoming event is 06/06/2022. The value of the date is considered in milliseconds.) |
| | |
Click here to expand...
|
|---|
Syntax: $EXPR1 Equals $EXPR2
Example: Lifecycle Time Equals 2,592,000,000
Output: True (Assuming that the value of Lifecycle Time in the incoming event is 2,592,000,000.) |
|
|---|
Syntax: $EXPR1 Does not equal $EXPR2
Example: Lifecycle Time Does not Equal 7,776,000,000
Output: True (Assuming that the value of Lifecycle Time in the incoming event is 2,592,000,000.) |
|
Enumeration (or Enum) data types are related to integral constants that represent special values within a module. Slot enumerations specify acceptable values for a particular slot. The following table lists the out-of-the-box enumerations. Out-of-the-box enums cannot be edited or deleted. | |
|---|
| Lists the possible severity values for an event slot: Possible values: CRITICAL, MAJOR, MINOR, WARNING, INFO, OK, UNKNOWN | | Lists the possible priority values for an event. Priority 5 indicates the lowest priority and conversely Priority 1 is the highest priority. Possible values: PRIORITY_1,PRIORITY_2,PRIORITY_3,PRIORITY_4,PRIORITY_5 | | Lists the possible status values for an event slot. Possible values: OPEN, ACK, ASSIGNED,CLOSED,BLACKOUT | | Lists the possible category values for an event slot. Possible values: SLA_MANAGEMENT, CAPACITY_MANAGEMENT, SERVICE_CONTINUITY_MANAGEMENT, AVAILABILITY_MANAGEMENT, INCIDENT_MANAGEMENT, CONFIGURATION_MANAGEMENT, RELEASE_MANAGEMENT, PROBLEM_MANAGEMENT, CHANGE_MANAGEMENT, OPERATIONS_MANAGEMENT, SECURITY_MANAGEMENT, FINANCIAL_MANAGEMENT, SERVICE_DESK_MANAGEMENT | | Lists the possible subcategory values for an event slot. Possible values: USER_TRANSACTIONS, SYSTEM,NETWORK, DATABASE, APPLICATION, OTHER | | Lists the boolean values for an event slot. Possible values: FALSE, TRUE | | Lists the type of incident for an event slot. This incident is created on BMC Helix IT Service Management. Possible values: UNKNOWN, CAUSAL, IMPACTED |
Define a custom list of values for Enum data type event slots of the out-of-the-box event classes (except the Event base class) and custom classes. Specify custom enumerations in the event selection criteria. Additionally, specify custom enumerations in the If, Enrich, Variable, Function, Lookup, Trigger-if, and Unless actions on the enrichment policy workflow. Use event operators that are supported for out-of-the-box enumerations with custom enumerations for filtering event slots. For more information, see Out-of-the-box event operators. You can manage custom enumerations by using APIs. For more information, see Custom-enumeration-management-endpoints-in-the-REST-API. For example, you want to select events based on the device or application status. You could define the following custom list of values to indicate the device or application status and use this custom enumeration to process events: Device status enumeration ROUTER_STATE = [
{"value": "UP", "index": 0, "label": "Up"},
{"value": "DOWN", "index": 1, "label": "Down"},
{"value": "ADMIN_DOWN", "index": 2, "label": "Administratively Down"}
] Application status enumeration APPLICATION_STATE= [
{"value": "UNKNOWN", "index": 0, "label": "Unknown"},
{"value": "STANDBY", "index": 1, "label": "Standby"},
{"value": "PAUSED", "index": 2, "label": "Paused"},
{"value": "UNAVAILABLE", "index": 3, "label": "Unavailable"},
{"value": "STARTED", "index": 4, "label": "Started"},
{"value": "ACTIVE", "index": 5, "label": "Active"},
{"value": "STOPPED", "index": 6, "label": "Stopped"}
] To use this enumeration as a class attribute while creating event classes. see the POST /events/classes endpoint on the Event-management-endpoints-in-the-REST-API page. To understand a use case for custom enumerations, see Example-Enrich-events-according-to-the-device-status. |
