Event functions

Choose additional slots to add in the generated event for the selected class by using the option. You can also add slots for the event class that you selected in the Event Selection Criteria field while creating an advanced enrichment policy. For example, $NEW.Severity. This option does not list the read-only or internal slots. 

If you haven’t set a default value for a slot in the event class definition, the function considers the slot value that you enter.

If you have set a default value for a slot in the event class definition, but you haven’t added the slot in the function. In this case, the default value for the slot is considered the slot value.

Use the delete icon to delete the added slot.  Once you add and save a slot from the list, the slot is disabled for selection. To enable the slot, delete and add it again.

The date and List of integer data types are not supported for slots.

Inserts a note that you want to include in the event.

We recommend a character limit of 256 characters.

You can specify the following value for this input:

• Slot placeholders
  For example, %msg%, %severity%.
  When the policy is applied, the slot names in the existing or incoming events are replaced with appropriate slot values (not slot display values) from the incoming event.
• Variables
  For example, $dbname, $tablespace.
  When the policy is applied, the variable names are replaced with the variable values that you have configured in the policy workflow.

If you want to specify a comma in the note content, use the backslash (\) character before the comma.

Inserts a note that you want to include in the event.

We recommend a character limit of 256 characters.

You can specify the following values for this input:

• Slot placeholders
  For example, %msg%, %severity%.
  When the policy is applied, the slot names in the existing or incoming events are replaced with appropriate slot values (not slot display values) from the incoming event.
• Variables
  For example, $dbname, $tablespace.
  When the policy is applied, the variable names are replaced with the variable values that you have configured in the policy workflow.
  You cannot specify global variables directly. Instead, store them as local variables by using the Variable action and access the stored global variables through local variables.
• Existing or incoming event slot variables
  For example, $NEW.location or $OLD.msg.
  The variables are replaced with event slot values from the existing or incoming event.

If you want to specify a comma in the note content, use the backslash (\) character before the comma.

The new text of the note that you want to set in the existing note of the event.

We recommend a character limit of 256 characters.

You can specify the following values for this input:

• Slot placeholders
  For example, %msg%, %severity%.
  When the policy is applied, the slot names in the existing or incoming events are replaced with appropriate slot values (not the slot display values) from the incoming event.
• Variables
  For example, $dbname, $tablespace.
  When the policy is applied, the variable names are replaced with the variable values that you have configured in the policy workflow.

If you want to specify a comma in the note content, use the backslash (\) character before the comma.

Specify a comma-separated list of node attributes that you want to fetch from BMC Discovery. To refer to node attributes in BMC Discovery, run the GET/data/nodes/{node_id} endpoint by using the _node_id value present in an existing event. 

For more information, see Endpoints in the REST API.

The state attribute returned in the API response contains the node attribute details that you could specify for this input.

The attributes can be specified by using standard JSON path conventions. For example, the following attribute list can be used to retrieve node attributes:

["kernel", "os", "model", "kind", "__all_ip_addrs[0]"]

After the attributes are fetched, you can use these attributes as local variables in the function input by using the $NODE prefix to further enrich events. For example: $NODE. kernel and $NODE.os.

Make sure that you provide the node attribute name as it exists in BMC Discovery. If you provide an attribute name for which there is no value present in BMC Discovery, the variable name is set as the variable value in the enriched event. For example, assuming that the kernel value is not present in BMC Discovery, the detailed message slot is set to $NODE. kernel in the enriched event instead of the actual value and the _errors slot in the event is populated with the reason for the failure.

Specify the criteria for fetching nodes from BMC Discovery. You can specify event slots or variables of the String data type.

For example: ( $NEW.source_hostname in name OR $NEW.source_hostname in short_name )

Here, the operand before the operator is the event slot value in BMC Helix Operations Management, which you want to search, and the operand after the operator is the attribute name in BMC Discovery.

The in and has_subword operators are supported in the node selection criteria. The AND and OR logical operators are supported.

Specify a comma-separated list of node attributes that you want to fetch from BMC Discovery. To refer to node attributes in BMC Discovery, run the GET/data/nodes/{node_id} endpoint by using the _node_id value present in an existing event. 

For more information, see Endpoints in the REST API.

The state attribute returned in the API response contains the node attribute details that you could specify for this input.

The attributes can be specified by using standard JSON path conventions. For example, the following attribute list can be used to retrieve node attributes:

["type", "os", "model", "os_class"]

After the attributes are fetched, you can use these attributes as local variables in the function input by using the $NODE prefix to further enrich events. For example: $NODE.type and $NODE.os.

Make sure that you provide the node attribute name as it exists in BMC Discovery. If you provide an attribute name for which there is no value present in BMC Discovery, the variable name is set as the variable value in the enriched event. For example, assuming that the kernel value is not present in BMC Discovery, the detailed message slot is set to $NODE. kernel in the enriched event instead of the actual value and the _errors slot in the event is populated with the reason for the failure.

Specify the node kind. For example, the following node kinds in BMC Discovery are supported:

Select this check box to skip both the node and service enrichment in an event.

Select this check box to skip the service enrichment but perform the node enrichment in an event.

Specify the criteria for fetching nodes from BMC Discovery. You can specify event slots or variables of the String data type.

The in and has_subword operators are supported in the node selection criteria. The AND and OR logical operators are supported.

For example:

• $NEW.source_hostname in name
• name has_subword $NEW.source_hostname
• ( $NEW.source_hostname in name OR short_name has_subword $NEW.source_hostname ) AND $NEW._ci_id in external_ids

$NEW.source_hostname and $NEW._ci_id are the event slot values in BMC Helix Operations Management and name, short_name, and external_ids are the attribute names in BMC Discovery.

Enclose the words with quotation marks to find the number of words in the text without considering their order.

For example, os_type has_subword "Red Hat Linux." 

This condition is true if all the words "Red", "Hat", and "Linux" are found as subwords of the full text not limiting results to the exact phrase match.

For example, if os_type is "Red Hat Enterprise Linux" or "Enterprise Linux Red Hat ", the search in the previous example returns true.