Skip to Content
Information

This site will undergo a brief period of maintenance on Friday, 18 December at 12:30 AM Central/12:00 PM IST. During a 30 minute window, site availability may be intermittent.


Phrase matches

By default, keywords in a correlation match expression are delimited by space characters. If you specify several keywords within a correlation match expression, all keywords must be present in the target message for the message to match.

Information
Example

If you specify a correlation expression of invalid object access (without the quotation marks) it matches the input the object has invalid access rights, or access to the specified object is invalid, or invalid access to the specified object.

All three keywords must appear in the input sentence in any order.

It is often the case that an exact phrase, containing spaces, is required as the match target. To achieve this, you must enclose the phrase in single or double quotation marks to match the entire phrase. 

Warning

Note

To match a message that precisely contains invalid object anywhere in the message, you should enclose the phrase in balanced single or double quotation marks as part of the match expression.

You can match multiple phrases and keywords in a single message. Each phrase and keyword is delimited by a blank space and the phrases and keywords matches in any order.This matches both words and the space, but do not match invalid or object by itself.

Related topic

Simple-match-expressions

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC AMI Command Center for Security 5.9