Example: Enrich topology information by using event policy
To enrich the topology information, Sarah performs the following steps:
Actions used in the example
- Variable
- Function
For more information about actions, see Actions-for-advanced-and-time-based-enrichment.
To define the event selection criteria
- Select Configuration > Event Policies and click Create.
- In Event Selection Criteria, define a condition to select events that contain the message NodeAssociateHas.
The following image illustrates how the event selection criteria will look:

To learn how to construct the event selection criteria, see Creating-and-enabling-event-policies.
To build the policy workflow
On the Refinement page, perform the following steps:
- Add the Variable action by using the Concat function to concatenate the host value and store the function output in the $node.name variable.

- To add the Function action, use the AssociateEventToNode function to fetch the topology information by using custom event slots instead of the default topology slots and then Apply and Save the policy.

Results
The preceding policy workflow enriches the value of the event location and tags on the Event Details page.
Without event enrichment

With event enrichment

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*
