Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Network Node Manager i Software10.30

Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Manage the Number of Incoming Incidents > Establish Criteria or Relationships for Incoming Incidents > Pairwise Configuration Form (Correlate Pairs of Incidents)

Pairwise Configuration Form (Correlate Pairs of Incidents)

[This is the Context-Sensitive Help topic for the Incident Config: PairWise Configuration form.]

Use the Pairwise Configuration to pair the occurrence of one incident with another subsequent incident. See About Pairwise Configurations for more information.

To configure incident pairs:

Complete the steps in Prerequisites for Pairwise Configurations so you know exactly which two incidents or traps belong to this logical pair.
Navigate to the Pairwise Configurations form.
1. From the workspace navigation panel, select the Configuration workspace.
2. Expand the Incidents folder.
3. Select Pairwise Configurations.
4. Do one of the following:
  - To create a new pair configuration, click the New icon, and continue.
  - To edit an existing pair configuration, click the Open icon in the row representing the configuration you want to edit, and continue.
  - To delete a pair configuration, select a row and click the Delete icon.
Provide the basic definition of the pair of incidents for this correlation (see table).
When matching incidents, NNMi automatically takes into account the following values:
- SNMP Trap incidents. NNMi takes into account from which device the trap originated using the cia.address value of the source address of the trap.
- Management Event incidents. NNMi takes into account the name of the incident's Source Object and Source Node.
  
  Tip NNMi displays the Name value used to identify the Source Node and Source Object in the Source Node and Source Object attribute for each incident in the Incident form.
- Syslog Message incidents. NNMi does not automatically use any matching criteria.
Some incident pairs require additional details to verify an accurate match. If both incidents have custom incident attributes, you can refine the match criteria.

Optional. Navigate to the First Incident Payload Filter and Second Incident Payload Filter tabs, and specify the payload filter to use when identifying a valid pair of incidents. See Configure a Payload Filter to Enrich a Pairwise Incident Configuration.

Optional. Navigate to the Matching Criteria tab, and provide one or more custom incident attribute sets for NNMi to use as a filter when identifying a valid pair of incidents. See Matching Criteria Configuration Form (Identify Incident Pairs).

Tip When configuring the Matching Criteria, you do not need to specify any of the ciaNames that NNMi automatically takes into account . See Matching Criteria Configuration Form (Identify Incident Pairs)for more information.

Then, click Save and Close to save your changes and return to the previous configuration form.

The next time the two incidents in this pair are generated, the first one becomes a Child Incident of the second one. See About Pairwise Configurations for an example.

Pairwise Configuration Definition
Attribute	Description
Name	The name is used to identify the pairwise configuration and must be unique. Use a name that will help you to remember the purpose for this pairwise configuration. Maximum length is 64 characters. Alpha-numeric characters are permitted. No spaces are permitted.
Enabled	In the Basics group, verify that Enabled is selected.
First Incident Configuration	Identify the incident in the pair that would occur first in the logical sequence. Click the Lookup icon and select Quick Find. Choose the name of one of the predefined incident configurations. If you cannot find it, see Incident Configurations Provided by NNMi. This First Incident becomes the Child Incident when the Second (Parent) Incident occurs. For example, in the CiscoLinkDownUp Pairwise configuration, if a Cisco Link Up (Second Incident) occurs after a Cisco Link Down (First Incident), the Cisco Link Down is cancelled and correlated as a Child Incident under the Cisco Link Up.
Second Incident Configuration	Identify the incident in the pair that would occur second in the logical sequence.Click the Lookup icon and select Quick Find. Choose the name of one of the predefined incident configurations. If you cannot find it, see Incident Configurations Provided by NNMi. This Second Incident becomes the Parent Incident if it occurs after the First Incident. For example, in the CiscoLinkDownUp Pairwise configuration, if a Cisco Link Up (Second Incident) occurs after a Cisco Link Down (First Incident), the Cisco Link Down is cancelled and correlated as a Child Incident under the Cisco Link Up.
Description	Optional. Explain the purpose of your pairwise configuration for future reference. Type a maximum of 1024 characters. Alpha-numeric, spaces, and special characters (~ ! @ # $ % ^ & * ( ) _+ -) are permitted.
Author	Indicates who created or last modified the Correlation Rule. If the Author attribute value is Network Node Manager, any changes are at risk of being overwritten in the future. Click Lookup and select Show Analysis to display details about the currently selected Author. Click Quick Find to access the list of existing Author values. Click New to create an Author value.
Duration	NNMi uses the value you enter to determine the duration window in which it correlates the Pairwise incidents you specify. During the timeframe specified, NNMi enables a single (parent) incident to cancel multiple (child) incidents. The Duration is calculated from the `originOccurrenceTime` of the parent incident backwards in time, canceling any child incidents within the Duration specified. Note the following: By default, the Duration valus is 0 (zero). When the Duration value is 0, NNMi finds the most recently occurring incident that matches the First Incident specified in the Pairwise configuration, regardless of time. See First Incident Configuration for more information. The maximum duration value is 365 days.
Delete when Canceled	When enabled , after the Duration is reached, NNMi deletes any incidents that were canceled according to the Pairwise configuration and that occurred within the timeframe specified by the Duration attribute. When disabled, NNMi cancels the pairwise incidents as configured, but does not delete them.

Send Help Center feedback