Using custom filters to filter events

For advanced filtering options, such as viewing events from specific devices, you can create custom filters.

The following sections discuss the process of cresting and using custom filters.

events_CustomFilter.PNG

Related topics

Filtering-events-in-the-TrueSight-console

Custom-filters-versus-event-groups

Viewing-event-details-in-the-TrueSight-console

Filtering-devices

Accessing-the-event-table-views-from-the-TrueSight-console

Other filtering options

Using-event-groups-to-filter-events

Using-quick-filters-to-filter-events

Using-time-filters-to-filter-events

Global search

The following video (4:04) illustrates how to create custom filters.

Note

The following video displays screens from an earlier version, however, the information provided in the video is still relevant to the current version of the product.


icon-play.png https://www.youtube.com/watch?v=TMT3dip918E

To create custom filters

  1. From the Events action menu, select Create Custom Filtercallout_1.PNG.
    events_CreateCustomFilter.png

    If your event source is a remote cell (indicated by the icon cell.pngon the Events page), then the following filtering categories are not available in the custom filter:

    • Applications
    • Groups
    • Devices
    • Services

    Also, only the event classes and slots that are defined in the Infrastructure Management Server cells are available for filtering.


  2. Select one or more event status and severity. 
    Filtering is disabled if you do not select any event status or severity, and events with any status or severity are considered.

  3. Select any one of the applications, groups, devices, or services category. Use the drop-down box of the selected category to select one or more items.

    Notes

    • The applications, groups, devices, and services categories are populated based on your permissions. For more information, see Creating roles

    • The Devices list shows only 5000 devices at a time. You can search for a device that is not included in this list by typing the device name or your search text in the list box. The complete device list is searched based on the text and the matching device names are displayed in the list. 
  4. (Optional) Select the Table View if you want to associate the table view with this custom filter. You can associate both global and user defined table views with the custom filter.
  5. (Optional) To add advanced filtering options, select the Add Advanced Filter check box. See Advanced filtering for more information.

  6. Click Apply to apply the custom filter.

    Note

    The custom filter is applied but not saved. To make changes to the custom filter before saving it, select Create Custom Filtercallout_1.PNG.

    Ensure to save the custom filter before you navigate to a different page or restore default filters.

  7. From the Events action menu, select Save As New Filtercallout_2.PNG to save the custom filter.
  8. Enter the custom filter name and click OK.

Advanced filtering

  1. From the Class list, select a class.
    The sub-classes for the selected class are automatically selected.
  2. To filter events according to one or more event attributes, specify the following information for each attribute:
    1. (Optional) Select a left parenthesis or a NOT condition.

    2. Select an event attribute.

      The [confluence_note] macro is a standalone macro and it cannot be used inline. Click on this message for details.

    3. Select a comparison operator.

      The [confluence_note] macro is a standalone macro and it cannot be used inline. Click on this message for details.

    4. Enter a value against which you want the filter to compare.
    5. (Optional) Select a right parenthesis.
    6. To add another filter condition (event attribute), click dashboard_editRowAddRow.png
    7. Select a logical operator, AND or OR.
    8. Repeat step a through step g to add as many filter conditions as you want.
    9. To remove a filter condition, click dashboard_editRowDeleteRow.png in the corresponding filter condition row.

Comparison operators

Operator

Description

Slot types

==

Events are listed only if the slot value matches the comparison value.

Enum, String, Number, List of String

!=

Events are listed only if the slot value does not match the comparison value.

Enum, String, Number, List of String

>

Events are listed only if the slot value is greater than the comparison value.

Enum, String, Number

<

Events are listed only if the slot value is less than the comparison value.

Enum, String, Number

>=

Events are listed only if the slot value is greater than or equal to the comparison value.

Enum, String, Number

<=

Events are listed only if the slot value is less than or equal to the comparison value.

Enum, String, Number

Has prefix

Events are listed only if the slot value starts with the comparison value.

String, Number

Has suffix

Events are listed only if the slot value ends with the comparison value.

String, Number

Contains

Events are listed only if the slot value contains the comparison value.

String, Number, List of String

Within

Events are listed only if the slot value is an exact match with one of the comma-separated list of comparison values.

String, Number

Contains one of

Events are listed only if the slot value is an exact match with one of the comma-separated list of comparison values.

String, Number

Outside

Events are listed only if the slot value does not match with any of the comma-separated list of comparison values.

String, Number

Matches

Events are listed only if the slot value contains the comparison value.

You can provide the following parameters in addition to the comparison value:
%d - decimal integer number
%f - floating point real number
%c - single character
%s - string value

Consider the following example values in the message slot of eight events:

Event 1

Memory Consumption - 10 MB – on machine clm-dev-008700

Event 2

CPU utilization 85.35% – on machine clm-dev-007890

Event 3

Memory Consumption - 5 MB – on machine clm-dev-108781

Event 4

CPU utilization 75.95% – on machine clm-dev-087654

Event 5

Memory Consumption – 894  MB – on machine clm-dev-54657

Event 6

CPU utilization 68.45% – on machine clm-dev-37878

Event 7

Consumption of storage space is high on vm-dev-45 machine

Event 8

Utilization taking higher trend

When you use the matches operator for the message slot:

  • Message matches Consumption – %d
    Events 1, 3, and 5 are displayed, as the following criteria matches:
    Consumption as a constant and an integer variable listed after Consumption.
  • Message matches machine %s
    Events 1, 2, 3, 4, 5, and 6 are displayed as the following criteria matches:
    machine as a constant and a string variable listed after machine.

String, List of String

Subclass of

Events are listed only if they are a subclass or child class of the provided class.

Class

Superclass of

Events are listed only if they are a super-class or parent class of the provided class.

Class

To apply custom filters

  1. From the Events action menu, select View Saved Filters callout_3.PNG.
    The list of saved custom filters is displayed.
  2. Select a custom filter from the list.
  3. If you have associated a table view with this filter, the events are displayed according to the associated table view.

To perform operations on custom filters

  1. From the Events action menu, select View Saved Filters callout_3.PNG.
    The list of saved custom filters is displayed.
  2. From the action menu for the custom filter, you can edit, rename, or delete the custom filter.

    events_CustomFilterOperations.png

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*