Develop > Automate operator functions and event change detection > Event Web Service query language > Query filter criteria properties

Query filter criteria properties

Query filter criteria properties lists the available query filter criteria properties and supported operators.

Note If you want to filter using complex (nested) attributes, you must use brackets ([ ]) to show the nesting. When specifying complex attributes, the bracket characters ([ ]) must be escaped, for example, like this: query=related_ci%5Btarget_id="ffca22eea15268533029f17b4c01b008"%5D. For more information about filtering using complex attributes, see Complex attributes.

Query filter criteria properties

Property

Supported Operators

Type of Value

Supports order_by

Default for order_direction

application

EQ, NE, LIKE, IS NULL, IN

String Literal

yes

ascending

assigned_group

EQ, NE, IN

String Literal

yes

ascending by ID

assigned_group[id]

EQ, NE, IN

String Literal

yes

ascending by ID

assigned_group[name]

EQ, NE, IN

String Literal

yes

ascending by ID

assigned_user

EQ, NE, IN

String Literal

yes

ascending by ID

assigned_user[id]

EQ, NE, IN

String Literal

yes

ascending by ID

assigned_user[login_name]

EQ, NE, IN

String Literal

yes

ascending by ID

category

EQ, NE, LIKE, IS NULL, IN

 String Literal

yes

ascending
cause[target_id] EQ, IS NULL, IN String Literal (UUID)    
ci_resolution_info[hint_count] EQ, LT, GT, LTE, GTE, NE, IN Integer    
ci_resolution_info[matched_hint_count] EQ, LT, GT, LTE, GTE, NE, IN Integer    
ci_resolution_info[quality_metric] EQ, LT, GT, LTE, GTE, NE, IN Integer    
ci_resolution_info[status] EQ, NE, LIKE, IN String Literal    
close_key_pattern EQ, NE, LIKE, IS NULL, IN String Literal    
control_transferred_to[dns_name] EQ, NE, LIKE String Literal    
control_transferred_to[external_id] EQ, NE, LIKE, IS NULL, IN

String Literal

    
control_transferred_to[id] EQ, NE, LIKE, IS NULL, IN String Literal (UUID)    
control_transferred_to[state]

EQ, NE, IS NULL, IN

 String Literal (UUID)    
control_transferred_to[state]

EQ, NE, IS NULL, IN

 String Literal (UUID)    
correlation_rule[target_id]

EQ, NE, IS NULL, IN

 String Literal (UUID)    

ca[<CA name>]

EQ, NE, LIKE,IN

 String Literal

 

 

ca[<CA name>]

EQ, NE, LIKE,IN

 String Literal

 

 

custom_attribute_list[<CA_name>]

EQ, NE, LIKE, IN

 String Literal

 

 

description

EQ, NE, LIKE, IS NULL, IN

 String Literal

yes

ascending
duplicate_count EQ, LT, GT, LTE, GTE, NE, IN Integer yes ascending

eti_hint

EQ, NE, LIKE, IS NULL, IN 

 String Literal

 

 

eti_value_id

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 

id

EQ, NE, IN

String Literal (UUID)

 

 

instruction_available

EQ

Boolean

 

 

key

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 

log_only

EQ

Boolean

 

 

match_info[policy_name]

EQ, NE, LIKE, IN

String Literal

 

 

match_info[condition_id]

EQ, NE, LIKE, IN

String Literal

 

 

match_info[condition_name]

EQ, NE, LIKE, IN

String Literal

 

 
node[target_global_id] EQ, NE, IS NULL, IN String Literal    
node[target_id] EQ, NE, IS NULL, IN String Literal    

node_hints[hint]

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 

node_hints[node_core_id]

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 

node_hints[node_dns_name]

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 

node_hints[node_ip_address]

EQ, NE, LIKE, IS NULL, IN

String Literal

 

 

object

EQ, NE, LIKE, IS NULL, IN

 String Literal

yes

ascending
om_service_id EQ, NE, LIKE, IS NULL, IN String Literal    

om_user

EQ, NE, LIKE, IS NULL, IN

String Literal

yes

ascending

original_data

EQ, NE, LIKE, IS NULL, IN

String Literal

 

 
original_id EQ, NE, LIKE, IS NULL, IN String Literal    
originating_server [dns_name] EQ, NE, LIKE, IN String Literal    
originating_server [ip_address] EQ, NE, LIKE, IN String Literal    

priority

EQ, NE, LIKE, IS NULL, IN

 String Literal

yes

ascending

received_as_notify

EQ

Boolean

 

 

received_on_ci_downtime

EQ

Boolean

 

 

related_ci[sub_component]

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 

related_ci[sub_component]

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 

related_ci[target_global_id]

EQ, NE, IS NULL, IN

String Literal

 

 

related_ci[target_id]

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 

related_ci_hints[hint]

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 

sending_server [dns_name]

EQ, NE, LIKE, IN

 String Literal

 

 

sending_server [ip_address]

EQ, NE, LIKE, IN

 String Literal

 

 

sequence_number

EQ, LT, GT, GTE, LTE, NE, IN

Integer

yes

descending

severity

EQ, NE, IS NULL, IN

 String Literal

yes

ascending

skip_duplicate_suppression

EQ

Boolean

 

 
solution

EQ, NE, LIKE, IS NULL, IN

 String Literal yes ascending

source_ci[target_global_id]

EQ, NE, IS NULL, IN

String Literal

 

 

source_ci[target_id]

EQ, NE, IS NULL, IN

String Literal

 

 

source_ci_hints[hint]

EQ, NE, LIKE, IS NULL, IN

 String Literal

 

 
source_ci_hints[node[core_id]]

EQ, NE, LIKE, IS NULL, IN

 String Literal    
source_ci_hints[node[dns_name]]

EQ, NE, LIKE, IS NULL, IN

 String Literal    
source_ci_hints[node[ip_address]]

EQ, NE, LIKE, IS NULL, IN

 String Literal    
sourced_from[dns_name]

EQ, NE, LIKE, IS NULL, IN

 String Literal    
sourced_from[external_id]

EQ, NE, LIKE, IS NULL, IN

String Literal

    
sourced_from[id]

EQ, NE, IS NULL, IN

 String Literal (UUID)    

state

EQ, NE, IS NULL, IN

 String Literal

yes

ascending

sub_category

EQ, NE, LIKE, IS NULL, IN

 String Literal

yes

ascending

time_changed

LT, GT, GE, LE

Datetime

yes

descending

time_created

LT, GT, GE, LE

 Datetime

yes

descending
time_first_received LT, GT, GE, LE Datetime yes descending

time_received

LT, GT, GE, LE

Datetime

yes

descending

time_state_changed

LT, GT, GE, LE

 Datetime

yes

descending

title

EQ, NE, LIKE, IS NULL, IN

 String Literal

yes

ascending

type

EQ, NE, LIKE, IS NULL, IN

 String Literal

yes

ascending

Operator aliases

Operator aliases lists the verbose aliases for operators.

Operator aliases

Operator Alias
= EQ
!= NE
< LT
<= LTE
> GT
>= GTE
LIKE n/a

Value types

The query filter criteria properties listed in Query filter criteria properties can take the following types of values:

Value types

Value Type Description
String Literals

If you want to filter using string literals, you must surround them with double quotation marks (""). Comparisons of string literals are case sensitive.

If you must use one of the characters that must be escaped in a string literal (see URL escape codes for characters that must be escaped, you must escape the character using the dollar sign ($) instead of percent (%); for example, use query=title%20EQ%20"$3CMy title$3E" instead of query=title%20EQ%20'%3CMy title%3E'.

The following query returns all events whose title contains the strings cpu and value. The URL encoding $25 represents the SQL wildcard %, which matches zero or more characters (similar to the regular expression .*):

query=title%20LIKE%20"$25cpu$25value$25"

Note OMi 9.0x and earlier only supports single quotation marks (') and the percent (%) escape codes. String literal escape codes using the dollar sign ($) are not supported in OMi 9.0x. OMi 9.10 and later supports single (') and double (") quotation marks. HPE recommends that Event Web Service clients use double quotation marks.
Datetime

Must be specified in the XML Schema dateTime format. For more details about XML Schema data types, see the XML schema document, which you can find in the following location: http://www.w3.org/TR/xmlschema-2

Additionally, when specifying a time zone other than GMT using "Z", you must specify a "+" character. Since this is in the URL it must be URL encoded. See URL escape codes for characters that must be escaped.
Integer Positive and negative natural numbers, including 0.

Send Help Center feedback