Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Network Node Manager i Software10.30

Administer > Configure Incidents > Configure Syslog Message Incidents (ArcSight) > Syslog Message Configuration Form (ArcSight) > Configure Basic Settings for a Syslog Message Incident (ArcSight) > Include Custom Incident Attributes in Your Message Format (Syslog Message) (ArcSight)

Include Custom Incident Attributes in Your Message Format (Syslog Message) (ArcSight)

NNMi includes two categories of CIAs:

SNMP trap varbinds identified by the Abstract Syntax Notation value (ASN.1). NNMi turns varbinds into CIAs and maintains each varbind's position number.
Custom incident attributes provided by NNMi.

You cannot create Custom Incident Attributes.

You can use CIAs in your message format to extend the amount of information presented. To determine which CIAs are available for any particular incident type, open an Incident view, locate the incident and open the Incident form. Navigate to the Custom Attributes tab. A complete list of available CIAs (for that incident type) appears in the table.

To include a CIA in your message format, type the dollar-sign character ($)plus any of the following:

Varbind position number or asterisk (*) to include all varbind values
Name of the CIA
Object identifier (oid) of the CIA (useful when the varbind position number is not consistent among vendors)

Note A single incident cannot include two CIAs with the same name. However, two incidents can contain CIAs having the same names and values.

The following table presents some example formats with the subsequent output.

Example Incident Message Formats
Example Message Format	Output in Incident View
Possible trouble with $3	`Possible trouble with` <varbind 3>
Possible trouble with $11	`Possible trouble with` <varbind 11>
Possible trouble with $77 (where the varbind position 77 does not exist)	`Possible trouble with <Invalid or unknown cia> 77`
Possible trouble with $*	`Possible trouble with` <cia1_name: cia_value>, <cia2_name; cia_value>,< cian_name: cia_value>
Possible trouble with $3x	`Possible trouble with` <varbind 3>`x`
Possible trouble with $1.2.3.4.5	`Possible trouble with` <value of the CIA with oid of 1.2.3.4.5>
Possible trouble with $cia.sourceObject.UcmdbId	`Possible trouble with` <value of the CIA with name of cia.sourceObject.UcmdbId>

Tip NNMi provides an error message when a CIA cannot be found. For example, if you enter an unavailable varbind position, name, or object identifier (oid), NNMi returns an "Invalid or unknown cia" error message.

Send Help Center feedback