Performing event operations in the TrueSight console

Event operations change the status, priority, or ownership of an event. Your user role determines the event operations that you can perform. You can also click on the respective icon on the toolbar to perform the same operation.

Related topics

Permissions reference

Viewing-event-details-in-the-TrueSight-console

Monitoring-and-managing-events

The following table describes the basic event operations and results:

Icon	Event operation	Description
	Acknowledge Event	Recognizes the existence of an open event. This operation changes the event status from Open to Acknowledged.
	Assign To	Assigns ownership of an open, acknowledged, or assigned event to yourself or another person in the same account. This operation changes the event status from Open or Acknowledged to Assigned, and the event owner is updated with the selected user. If the event status is Assigned, only the ownership changes to the selected user.
	Close	Ignores the event in calculating status and disables any further event operation. You can close an Open, Assigned, or Acknowledged event.
	Decline Ownership	Removes ownership of an event in the assigned state. This operation changes the event status to Acknowledged.
	Set Event Priority	Assigns a priority level to the event.
	Take Ownership	Assigns ownership of Open or Acknowledged event to yourself.
	Unacknowledge Event	Changes a previously Acknowledged event back to the Open state.
	Launch Remote Actions	Displays a dialog box with a list of available remote actions. The list of remote actions change according to the selected event.
	View Remote Action Results	Navigates to the Remote Action Results tab of the Event Details page.
	Launch Performance Overview	Navigates to the Performance Overview tab of the Event Details page.
	Launch Probable Cause Analysis	Navigates to the Probable Cause Analysis tab of the Event Details page.
	View Event Details	Navigates to the Summary tab of Event Details page.
	Launch IT Data Analytics	Launches the Search page of the IT Data Analytics console for the events, populated with the host name and log files associated with the event, enabling you to continue investigating the root cause of the problem that may have triggered the events.
	Export	Exports the event content (all slots or visible slots) to .baroc, .XML, or .csv file formats.
	Add Notes	Displays the Add Notes dialog box.
	Cross-launch URLs	Displays a dialog box with a list of available cross-launch URLs. Cross-launch URLs enable you to access context-aware applications to troubleshoot or obtain additional information regarding an event (based on the data present in the event). Cross-launch URLs are created by administrators (with super admin privileges). As an administrator, you can specify the conditions for displaying the URL by specifying the number of slot values that must be present in an event for the URL to be accessible. For more information, see Configuring-context-aware-cross-launch-URLs. As an IT operator, you can view cross-launch URLs based on the following rules: Cross-launch URLs are applicable to your tenant. The conditions (slots) specified for displaying the cross-launch URL are met. Cross-launch URLs are not disabled. For more information, see Accessing cross-launch URLs.
	Change Table View	Displays the Select Table View dialog box.

This topic provides the following information about event operations:

To perform event operations on multiple events

You can select multiple events in the following ways:

Select events by pressing Ctrl-click. Doing this helps you select multiple, non-continuous events.
Select events by pressing Shift-click. Doing this helps you select multiple, continuous events.
Enable the Show check box for event selection setting and manually select the desired events. With this setting, you cannot make multiple continuous and non-continuous selections by pressing Ctrl-click and Shift-click respectively.

After selecting the events, use the event action menu to perform an event operation.

To customize the number of multiple events to perform event operations, see Customizing-the-display-of-the-event-list-in-the-TrueSight-console.

Tip

Enable the check box for events when you are using a mobile device to access the TrueSight console. See Customizing-the-display-of-the-event-list-in-the-TrueSight-console.

Note

Although all the event operations that are available to your user role are available when you select two or more events in the event list, an operation is performed only on the selected events whose status makes the operation valid. If the operation is not valid for some selected events, a warning box reports the internal IDs of those events and the reason that the operation is not valid. Click OK to execute the event operation on the applicable events, if any.

To make notes mandatory for event operations

By default, providing notes for event operations is optional.

As an administrator (or root user), you can force the insertion of notes for event operations such as acknowledging and unacknowledging an event, assigning an event, taking or declining ownership, closing an event, and setting the event priority. For example, unless you provide a note, you cannot acknowledge an event.

On the Presentation Server, go to
- (Windows) installationDirectory\truesightpserver\bin.
- (Linux) installationDirectory/.
Run this command: tssh properties set forceNotesForEventOps true reload
Log out and log in to the TrueSight console.

Note

The setting to force notes overrides the event preferences to not display the confirmation window. This means even if the event preferences for the Show confirmation for setting is set to the Close event only or None options, the confirmation window for inserting notes will continue to be displayed.

To acknowledge an event

From the event list, select one or more open events.
From the event action menu, select Acknowledge Event or from the event toolbar, click .
In the confirmation window, enter notes for the event and click OK.
Insertion of notes can be mandatory or optional based on whether the administrator has enabled the setting to force notes.
The icon appears in the event status column to indicate that you have acknowledged the event.

To take ownership of an event

From the event list, select one or more open or acknowledged events.
From the event action menu, select Take Ownership or from the event toolbar, click .
In the confirmation window, enter notes for the event and click OK.
Insertion of notes can be mandatory or optional based on whether the administrator has enabled the setting to force notes.
The icon appears in the event status column to indicate that you have taken ownership of the event.

To decline ownership of an event

From the event list, select one or more events that you own.
From the event action menu, select Decline Ownership or from the event toolbar, click .
You can decline an event only if you are the owner of that event.
In the confirmation window, enter notes for the event and click OK.
Insertion of notes can be mandatory or optional based on whether the administrator has enabled the setting to force notes.
The icon appears in the event status column to indicate that you have acknowledged the event.

To close an event

From the event list, select one or more open, assigned, or acknowledged events.
From the event action menu, select Close Event or from the event toolbar, click .
In the confirmation window, enter notes for the event and click OK.
Insertion of notes can be mandatory or optional based on whether the administrator has enabled the setting to force notes.
The icon appears in the event status column to indicate that you have closed the event.

Notes

You cannot close an abnormality event.
When you close an alarm event, it can take up to 2 minutes for the status to change.
Closing App Visibility events and Synthetic Monitor events in this view does not close the events in App Visibility.
- To close a Synthetic Health event, see Analyzing synthetic health event details.
- App Visibility events, and Synthetic Monitor SLA events are closed automatically when they are no longer relevant.

To assign an event

From the event list, select one or more events.
From the event action menu, select Assign Event or from the event toolbar, click .
Select a user to whom you want to assign the event, enter notes for the event and click OK.
Insertion of notes can be mandatory or optional based on whether the administrator has enabled the setting to force notes.
The icon appears in the event status column to indicate that you have assigned the event.
How to assign events to relevant users (based on user group)?
While assigning an event, instead of scrolling through a list of all users available in the system, you can filter them based on user group. To do this, you need to first enable the Show users from the selected user group for the 'Assign To' operation setting and then select a user group. If you do not have relevant user groups already created, we recommend that you create new user groups to be able to use this capability.
At the time of assigning the event, you can see the default user group selected. The default selection is populated from the event preferences. You can now select a user associated with the user group.
You can even change the user group selection and associated user selection. The user groups displayed are directly related to the logged-in user. You see only those groups of which you are a member.
To see the complete list of users, you can change the user group selection to All Users.

To set the priority of an event

From the event list, select one or more open, assigned, or acknowledged events.
From the event action menu, select Set Event Priority or from the event toolbar, click .
Select the priority to assign to the event or events, enter notes for the event and click OK.
Insertion of notes can be mandatory or optional based on whether the administrator has enabled the setting to force notes.
The priority icon and text is updated to reflect the newly-assigned priority.

To unacknowledge an event

From the event list, select one or more acknowledged events.
From the event action menu, select Unacknowledge Event or from the event toolbar, click .
If a confirmation window appears, enter notes for the event and click OK.
Insertion of notes can be mandatory or optional based on whether the administrator has enabled the setting to force notes.
The icon appears in the event status column to indicate that the event is in the open state.

To launch a remote action on an event

From the Events page, select one or multiple events.
From the event action menu, select Launch Remote Actions or from the event toolbar, click .
The Launch Remote Actions option is also available from the Event Details page.
In the Remote Actions window, select a remote action, and click Launch.
In the Execute Action dialog box, enter the appropriate values required to run the selected remote action, and select Execute.

To view the remote action results

In the Events page, the icon indicates that the event contains a remote action result.
Click the icon or from the event action menu, select View Remote Action Results or from the event toolbar, click .
The Remote Action Result tab of the Event Details page displays the results, including the errors, if any.
The following codes indicate the remote action result:
Zero
Success
Non-zero
Failure
-1
In progress
From the Remote Actions action menu, you can export the results to .BAROC, .CSV, or .XML formats.

To launch the performance overview

From the Events page, select a event.
From the event action menu, select Launch Performance Overview or from the event toolbar, click .
The Performance Overview tab of the Event Details page displays a historical graph of the monitored object for which the event occurred.

To launch the probable cause analysis

From the Events page, select a event.
From the event action menu, select Launch Probable Cause Analysis or from the event toolbar, click .
The Probable Cause Analysis tab of the Event Details page displays the relevant events based on probable cause analysis of the data.

To view the event details

From the Events page, select a event.
From the event action menu, select View Event Details or from the event toolbar, click .
The Summary tab of the Event Details page displays key information about the event, such as status, severity, priority, date and time of occurrence, object class, object name, host, owner, message, and detailed message. Alarms and abnormalities are also displayed in the Summary tab.

To launch the IT Data Analytics console

From the Events page, select one or multiple events.
From the event action menu, select Launch IT Data Analytics or from the event toolbar, click .
The IT Data Analytics console displays the relevant details for the selected events.

To export data for an event

From the event list, select one or more events.
From the event action menu, select Export or from the event toolbar, click .
In the Export window, select the format and content and click Export.
The event content is exported for all slots or visible slots to .baroc, .XML, or .csv file formats.

To add notes for an event

From the event list, select one or more events.
From the event action menu, select Add Notes or from the event toolbar, click .
Enter any notes for the event and click OK.

To access cross-launch URLs

From the event list, select an event.
Proceed in one of the following ways:
1. From the event action menu, select Cross-launch URLs.
2. From the event toolbar, click .
In the Cross-Launch URLs window, select a cross-launch URL name and click Launch.
The cross-launch URL opens in a new tab.

To change the table view for an event

From the event list, select one or more events.
From the event toolbar, click .
In the Select Table View window, select an appropriate table view and click OK.
When you change the table view, the table view icon changes to .