Set filters

You can narrow down the number of events in the Event Browser by using filters. You can specify filters for the following:

• String attributes
• Time properties
• Flag attributes
• Event priorities

Filter Parameters for the URL Launch of the Event Browser contains the filter parameters available for the URL launch of the Event Browser.

Filter Parameters for the URL Launch of the Event Browser

Filter Parameter	Description	Values
filter_assignment	Applies an assignment filter to the Event Browser.	One or more of: me my_workgroups others nobody
filter_severities	Applies a severity filter to the Event Browser.	One or more of: unknown normal warning minor major critical
filter_states	Applies a lifecycle state filter to the Event Browser.	One or more of: open in_progress, resolved

Filtering by String Attributes

You can filter events by string attributes.

You specify filters to filter by properties of type string using the following format:

filter_<stringAttributeName>_<filterType>

Possible values for string attribute names and filter types are listed in Possible Filter Types and Values for String Attributes.

Possible Filter Types and Values for String Attributes

Possible string attribute names	application
	ca_<customAttribute>
	category
	correlationKey
	description
	object
	originalText
	relatedCiHint
	subCategory
	title
	type
Possible filter types	contains
	equals
	isEmpty
	isNotEmpty
	notContains
	notEquals

Here is an example of filtering by string attributes, where we are interested only in returning events that have a filter category called Network:

filter_category_equals=Network

Filtering by Time Properties

You can also filter events by time properties.

You can set the filter so that the Event Browser displays only those events for which the time attribute timeAttributeName is between fromTime and toTime.

You specify filters to filter by time using the following format:

filter_<timeAttributeName>=fromTime-toTime

where:

<timeAttributeName> can be one of: timeCreated, timeFirstReceived, timeReceived, timeStateChanged.

You must specify the time in the following format:

<yyyyMMddHHmmss>

where:

• yyyy is the year
• MM is the month value (01-12)
• dd is the day value (01-31)
• HH is the hour value (00-23)
• mm is the minute values (00-59)
• ss is the second value (00-59)

Filtering by Priorities

You can also filter events by priorities.

You can set the filter so that Event Browser displays the events according to their priorities.

You specify filters to filter by priorities using the following format:

filter_priorities=<priority_level>

where:

<priority_level> can be one or more of the following in a comma-separated list: none, lowest, low, medium, high, highest.

As an example, if you want the Event Browser is to display only those events with the priorities highest and high, then you would specify the filter as follows:

filter_priorities=highest,high

Filtering by CIs and CI Types

You can set a filter so that the Event Browser displays only the events that are related to a given CI. To specify such a filter, use the following format:

filter_relatedCi_equals=<CI Id>

where:

<CI Id> is the ID of the CI.

Possible filter operations are: equals, isempty, notisempty

You can also set a filter so that the Event Browser displays only events where the CI type of the related CI matches the CI type specified. To specify such a filter, use the following format:

filter_ciType_<operator>=<type>

where <type> is the specified CI type, and <operator> can have one of the following values: equals, is_derived.

Filtering by Global CI ID

You can filter events by global CI ID. The global CI ID is the global ID of a CI in an external (non-OMi) database, such as a Content Management System (CMS) database.

When specifying the globalCiId parameter, the local (ODB) CI ID is looked up and a filter for that CI ID is set up.

To specify such a filter, use the following format:

filter_globalCiId_equals=<global id>

where:

<global id> is the global ID of the CI.

Possible filter operations are: equals, isempty, notisempty

The filter specification filter_globalCiId_equals=<global id> returns the same result as the filter specification filter_relatedCi_equals=<CI Id>.

Filtering by ETIs and ETI Values

You can set a filter so that the Event Browser displays only the events that match a given ETI.

To specify a filter by ETI, use the following format:

filter_eti_equals=<ETI Id>

where:

<ETI Id> is the UUID of the ETI.

Possible filter operations are: equals, isempty, notisempty, isoneof.

When using the isoneof filter operation, a comma-separated list of ETI UUIDs is expected, for example:

filter_eti_isoneof=<ETI Id1,ETI Id2,ETI Id3,...>

For the filter operations isempty and notisempty, no argument is expected.

You can also set a filter so that the Event Browser displays only events that set a specific ETI Value. To specify such a filter, use the following format:

filter_etiValue_<operator>=<ETI value Id>

where:

<ETI value Id> is the UUID of the ETI Value.

Possible filter operations are: equals, isempty, notisempty, isoneof.

When using the isoneof filter operation, a comma-separated list of ETI value UUIDs, is expected, for example:

filter_etiValue_isoneof=<ETI value Id1,ETI value Id2,ETI value Id3,...>

For the filter operations isempty and notisempty, no argument is expected.

Filtering by Other Event Characteristics

You can also set a filter to group events that share the same characteristic. For example, you may want to see only those events that have duplicates.

To filter events to group them by event characteristics, there are a number of boolean flag attributes that you can specify. These boolean flag attributes specify whether the event possesses a particular characteristic, for example, whether it has symptoms, or annotations. You can set the filter so that the Event Browser displays only those events that match the boolean flag attribute for the specified characteristic.

To set a filter to display events that share a particular characteristic, you specify the boolean flag attribute for that characteristic using the following format:

filter_<flagAttributeName>

where:

<flagAttributeName> can have one of the following values: hasSymptoms, hasCause, hasDuplicates, hasAnnotations.

You can also specify a combination of characteristics, as in the following example where the filter is set to display only those events that have both duplicates and symptoms:

https://<my.example.com:8080>/opr-console/opr-evt-browser?filter_hasDuplicates&filter_hasSymptoms