Important This documentation space contains information about PATROL Agents when deployed in a BMC Helix Operations Management environment. If you are a TrueSight Operations Management user, see PATROL Agent 21.02.

Text filtering events

You can filter events by either substring matching or regular expression matching.

Substring matching

Substring matching allows you to filter all events containing a particular string such as "alarm", "warn", or "Cpubusy".

Example

To search for all events containing the word "State", set the event filter to the following example:
"State", # PatternFilter - sub-string matching

Any ALARM event containing "State" in the description will be returned regardless of where "State" is located in the description.

Regular expression matching

Regular expression matching allows you to filter all events containing a particular string in a particular position. You can use regular expression matching in the following event attributes:

  • Node
  • Description/diary
  • Class
  • Origin

You can also search for items that do not match a regular expression. To do so, you use the syntax ^/ instead of /. The syntax serves a similar purpose as using grep -v.

Example

To search for events starting with "State" in the description, set the event filter to the following example:
"/^State/", # PatternFilter - Regular expression matching

To search for events ending with "State" in the description, set the event filter to the following example:
"/State$/", # PatternFilter - Regular expression matching

To search for events that include only "State" in the description, set the event filter to the following example:
"/^State$/", # PatternFilter - Regular expression matching

To search for events that do not start with "State" in the description, set the event filter to the following example:
"^/^State/", # PatternFilter - Negate Regular expression matching