Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Network Node Manager i Software10.30

Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Manage the Number of Incoming Incidents > Establish Criteria or Relationships for Incoming Incidents > Configure Custom Correlations

Configure Custom Correlations

[This is the Context-Sensitive Help topic for the Custom Correlation Configuration form.]

For information about each Custom Correlation Configuration tab: See Also

NNMi enables you to correlate groups of incidents under a Parent Incident. This feature is useful when you want to define a relationship between a number of incidents potentially from different network objects that form a logical set to identify a problem. The set of correlations is considered complete if all of the incidents arrive within a specified time window.

When configuring a Custom Correlation, you configure one or both of the following:

Rule	Description
Correlation Rule	Tip Configure a Correlation Rule when you want to correlate only one type of Child incident Configuration with a Parent Incident Configuration that is generated by NNMi. Use a Correlation Rule to specify the following: Parent Incident Configuration Child Incident Configuration Filters that NNMi should use when selecting the Parent and Child Incident instances for correlation The time window within which NNMi begins to correlate the incidents. Note If the Parent and Child incidents occur within the Correlation Window Duration specified, NNMi begins to correlate the incidents as soon as they occur. The regular expression (Correlation Filter) that defines the relationship requirements that must be met before the incidents are correlated The Parent and Child Incident do not have to be the same incident configuration. For example, you can correlate an Address Not Responding incident with an Interface Down incident. See Correlation Rule Example for a step-by-step example of how the Subinterface Correlation Rule provided by NNMi was created.
Causal Rule	Tip Configure a Causal Rule when you want to cause NNMi to generate a Parent Incident and you want to correlate one or more Child Incident Configurations under the Parent Incident that you cause to be generated. Use a Causal Rule to specify the following: Parent Incident Configuration to be generated One or more Child Incident Configurations to be correlated under the generated Parent Incident Filters that NNMi should use when selecting the Child Incident instances for correlation Source Object and Source Node filters to be used to determine the Source Node and Source Object for the generated Parent Incident The time window that must be met before NNMi correlates the incidents. Note NNMi waits until the Correlation Window Duration has passed before generating the Parent Incident and correlating its Child Incidents. To establish a relationship between multiple Custom Correlations, configure a Causal Rule to generate a Parent Incident that becomes the Child Incident of another Parent Incident. See "Causal Rule Example" for a step-by-step example of creating a Causal Rule.

Rule

Description

Correlation Rule

Tip Configure a Correlation Rule when you want to correlate only one type of Child incident Configuration with a Parent Incident Configuration that is generated by NNMi.

Use a Correlation Rule to specify the following:

Parent Incident Configuration
Child Incident Configuration
Filters that NNMi should use when selecting the Parent and Child Incident instances for correlation
The time window within which NNMi begins to correlate the incidents.

Note If the Parent and Child incidents occur within the Correlation Window Duration specified, NNMi begins to correlate the incidents as soon as they occur.
The regular expression (Correlation Filter) that defines the relationship requirements that must be met before the incidents are correlated

The Parent and Child Incident do not have to be the same incident configuration. For example, you can correlate an Address Not Responding incident with an Interface Down incident.

See Correlation Rule Example for a step-by-step example of how the Subinterface Correlation Rule provided by NNMi was created.

Causal Rule

Tip Configure a Causal Rule when you want to cause NNMi to generate a Parent Incident and you want to correlate one or more Child Incident Configurations under the Parent Incident that you cause to be generated.

Use a Causal Rule to specify the following:

Parent Incident Configuration to be generated
One or more Child Incident Configurations to be correlated under the generated Parent Incident
Filters that NNMi should use when selecting the Child Incident instances for correlation
Source Object and Source Node filters to be used to determine the Source Node and Source Object for the generated Parent Incident
The time window that must be met before NNMi correlates the incidents.

Note NNMi waits until the Correlation Window Duration has passed before generating the Parent Incident and correlating its Child Incidents.

To establish a relationship between multiple Custom Correlations, configure a Causal Rule to generate a Parent Incident that becomes the Child Incident of another Parent Incident.

See "Causal Rule Example" for a step-by-step example of creating a Causal Rule.

To configure a Custom Correlation:

Navigate to the Custom Correlation Configuration form:
1. From the workspace navigation pane, select the Configuration workspace.
2. Expand the Incidents folder.
3. Select Custom Correlation Configuration.
View the configured attributes (see table).
Do one of the following, or both:
- Configure one or more Correlation Rules. See Configure a Correlation Rule for more information.
- Configure one or more Causal Rules. See Configure a Causal Rule for more information.
Click Save and Close to save your changes and return to the previous form.

Custom Correlation Registration Attribute
Attribute	Description
Last Modified	The date and time the Custom Correlation configuration was last modified.

Send Help Center feedback