Types of filters

BMC AMI Datastream supports different types of filtering, depending on the field type. The type of filtering (if any) supported by each field is indicated in the Name (Filter) column in Supported-SMF-field-names.

Important

You cannot use these filters on fields that are you define using GFlist or FFlist.

This section provides information about the following topics:

Boolean filters
EGNX filters
Integer filters
Mapped integer filters

Boolean filters

Filters for fields that support a Boolean filter require a specification of Yes or No, or one of the values specified by OPTions BOOLValues. Yes and No might be abbreviated as Y and N respectively.

EGNX filters

EGNX Filters support Enhanced Generic Naming eXtended (EGNX) comparisons and regular expression (RegEx) matching. EGNX is based on RACF Enhanced Generic Naming (EGN). EGN is described in the IBM manual z/OS Security Server RACF Command Language Reference. The IBM manual contains multiple examples of data set names that match or do not match particular EGN specifications. EGNX allows you to use wildcard or generic indicator characters in a literal as follows:

Indicator	Matches …
% (percent sign)	Any single character in the field value.
* (asterisk)	Zero or more characters up to the next slash (/), period (.) or the end of the field value. An asterisk indicator in the literal must immediately precede a slash, a period or the end of the literal.
** (double asterisk)	Zero or more characters possibly spanning multiple periods or slashes.

EGNX extends EGN in three ways:

A node is defined as any number of characters terminated by a period or a slash.
A wildcard or generic indicator might appear in the first node.
The double asterisk (**) might appear anywhere; it need not represent one or more entire nodes. (However, the restrictions of EGN that a single asterisk must be followed immediately by a node terminator, and the restriction that only one double asterisk (**) might appear, remain in effect.)

For some real-world examples of EGNX filters, see the first two examples under Filter-examples.

Regular expressions are a way of specifying patterns for matching text.

BMC AMI Datastream supports what are generally referred to as Extended Regular Expressions.

Filter	Description
relation	One of the operators listed under Logical-test-is-True-if The comparison is field to literal; that is, an operator of (>) specifies that in order for the logical test to be true, the value of the field must be greater than the value of the literal. If you use a double asterisk (**) in the literal, then the relation must be IN, NI or one of the operators for equal or not equal.
IN \| NI	IN and NI (not in) are not case sensitive; you can use upper, lower, or mixed case. You can specify any number of literals, including zero. IN—For the condition to be true, the field must be equal to one of the literal values coded. An IN comparison against an empty list of literals is always false. NI—For the condition to be true, the field must not be equal to any of the literal values coded. An NI comparison against an empty list of literals is always true.
egnxLiteral	Specify a literal value enclosed in single or double quotation marks. See the description of EGNX. If the literal contains a double asterisk (**) then only equal and not equal comparisons (including IN and NI) are allowed. The comparison is case-sensitive: TEMP does not compare equal to Temp or temp. Trailing blanks in record fields are ignored, so a field containing SYS010 compares equal to a literal of SYS010.
RX \| NRX	Specifies a regular expression comparison. An RX condition is true if the field matches the specified regular expression; an NRX condition is true if the field does not match.
ICASE	Specifies that regular expression processing should ignore case. This parameter is optional; if omitted then regular expression processing is case-sensitive.
regularExpression	Specifies the regular expression to be matched against the field value.

Integer filters

Filter	Description
relation	One of the operators listed under Logical-test-is-True-if The comparison is field to literal; that is, an operator of (>) specifies that in order for the logical test to be true, the value of the field must be greater than the value of the literal.
IN \| NI	IN and NI (not in) are not case sensitive; you can use upper, lower, or mixed case. You can specify any number of literals, including zero. IN—For the condition to be true, the field must be equal to one of the literal values coded. An IN comparison against an empty list of literals is always false. NI—For the condition to be true, the field must not be equal to any of the literal values coded. An NI comparison against an empty list of literals is always true.
extendedNumericLiteral	Literal number in the range from ±2⁶³-1or roughly ±9 followed by 18 zeros using any of the formats described in the "Signed extended numeric format" section of Extended-numeric-format

Mapped integer filters

Filter	Description
relation	One of the operators listed under Logical-test-is-True-if The comparison is field to literal; that is, an operator of (>) specifies that in order for the logical test to be true, the value of the field must be greater than the value of the literal.
IN \| NI	IN and NI (not in) are not case sensitive; you can use upper, lower, or mixed case. You can specify any number of literals, including zero. IN—For the condition to be true, the field must be equal to one of the literal values coded. An IN comparison against an empty list of literals is always false. NI—For the condition to be true, the field must not be equal to any of the literal values coded. An NI comparison against an empty list of literals is always true.
mappedIntegerLiteral	Specify a literal in one of the formats described as follows.

Extended numeric literal

Code a number in the range ±2⁶³‑1 or roughly ±9 followed by 18 zeros, using any of the formats described in the "Signed extended numeric format" section of Extended-numeric-format.

Mapped text literal

Specify a character string enclosed in single or double quotation marks. The character string must correspond to the textual description used by BMC AMI Datastream for formatting the numeric field. Correspond to means the text either exactly matches the description, or is a leading substring of exactly one description for the field. The comparison is case-insensitive. For example, the field SMF80R3Req uses the following textual descriptions:

Numeric value of SMF80Req	Textual description as formatted by BMC AMI Datastream
2	WRITE
4	IBM Reserved
8	NONE
16	READ
18	READ+WRITE
32	UPDATE
64	CONTROL
128	ALTER

You could code 'w', "WR" or 'Write' as a synonym for 2 because they are leading substrings of only that one value. You could code 'read' or "READ" as a synonym for 16 because it is an exact match, but you could not code 'R' because it is a leading substring of two textual descriptions, READ and READ+WRITE.

The mapped text you code is converted to a numeric value at the time the parameter file is processed; there is no performance penalty for specifying mapped text rather than a numeric value.