Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Operations Manager i10.62

Administer > Event Processing > Topology-Based Event Correlation > Topology-Based Event Correlation Overview

Topology-Based Event Correlation Overview

You can define rules that use indicators to correlate or link related events occurring in the different domains of the managed IT environment. Correlating events that are either generated by or related to the same object greatly reduces the number of events displayed in the Event Browser. The reduced number of events in the Event Browser helps operators to locate the cause of the problems more quickly and efficiently.

The correlation process determines the cause of an event. An overview of all events affected by the correlation process is available separately in the Related Events tab of the Details pane. The overview enables you to drill down the correlation history and browse through all correlated events.

The event correlation process uses the topology-based views (Pattern Views and Template Views, using direct links only) stored in the RTSM to specify which configuration item types can be considered for inclusion in a correlation rule. Topology-based event correlation requires that a relationship exists between the configuration items specified in the correlation rule.

Note The view used to define the configuration item types in a correlation rule must also demonstrate that a relationship exists between the configuration item types specified in the rule.

A time limit exists for the processing of the correlation rules you define with the Correlation Rules manager. All the events specified in the correlation rule must occur within a defined period of time. By default, the time limit is set to 960 seconds. If individual symptom or cause events occur outside of the defined time limit, they appear in the Event Browser as normal, uncorrelated events. For more information about the time setting, see Set the Correlation Time Limit.

Send Help Center feedback