Event Filters

By default, filters for the Event Browser are visible and available only to the user who created them. Users with appropriate OMi administration permissions can share filters, making an existing filter available to all users, or users that have permissions for a specific event filter category. For details, see Sharing Filters.

You can create filters for use in the Event Browser, the Closed Events Browser, the Monitoring Dashboard, and many OMi administration areas.

Filters used in administration, for example, in Forwarding Rules or Notifications, are bound to their administration area and are not visible or usable in any other context.
You can apply a different filter for each instance of a perspective. Filters defined for the Event Browser are also available in the Closed Events Browser and vice versa. However, the Event Browser cannot display active and closed events at the same time.

When creating or editing an event filter, you can enable the Share this filter option if your administrator assigned you the permission to share event filters. You can share the filter either with all OMi users, or users that have permission for a specific event filter category.

Administrators can enable users to share event filters, and assign a user's or a group's role permissions to view filters shared with specific event filter categories. They can also add additional categories. For more information, see Users, Groups, and Roles.

When investigating closed events using the Closed Events Browser, you specify the time period of interest and optionally an event filter to further reduce the number of events in the selected range. Not every event filter can be applied to closed events. Filters that contain matches or not matches operators cannot be applied. Only closed events with the specified filter criteria are loaded from the database.

When adding a condition to a filter, you can use the matching criteria matches and not matches to specify a regular expression that the filter compares with the events.

The pattern uses the syntax of the Java regular expressions class java.util.regex. For the exact syntax of this class, see the online Java documentation.

Processing filters that contain regular expressions requires higher resources than for filters without them and it is recommended that regular expressions are used only when a simpler alternative is not possible.

Some additional examples of regular expressions are listed below:

• .*Down

  To match a title that ends with the word Down (for example Interface Down, or Connection Down).

• OpsCx|SiS|Internal

  To match one of the following categories: OpsCx, SiS, or Internal.

• ^KM\d+.*

  To match a title that starts with the abbreviation KM and any number of digits.

• ^\d{5}.*

  To match a title that contains five or more digits in the beginning, followed by any combination of letters and digits.

• ^Automatic assignment of *.[template|aspect].*

  To match a title that contains the string "Automatic assignment of <any text>" followed by the string "template" or "aspect" and more text after that.

In this task, you learn how to filter the events displayed in the Event Browser according to a view. Only events related to configuration items included in the selected view appear in the Event Browser.

To filter events by views:

1. Start the Event Perspective or Health Perspective:

   Workspaces > Operations Console > <select a perspective>

2. Do one of the following:

   • In the View Explorer, select a view from the drop-down list.

   • In the Event Browser, select a view from the View Selector. The five most recent selections are displayed at the top of the list.

   The events displayed in the Event Browser are limited to events associated with the selected view.

   Note  

   • The OMi perspectives are wired so that selecting a view in the Event Browser View Selector disables the CI selected in the View Explorer.

   • The Event Browser View Selector is disabled in locked Event Browser pages so that only events associated with a preselected view are displayed.

In this task, you learn how to filter the events displayed in the Event Browser by configuration item. Only events related to the selected configuration item appear in the Event Browser.

To filter events by configuration item:

1. Start a perspective containing an Event Browser and a View Explorer or a CI Explorer, for example, the Event Perspective or the Health Perspective:

   Workspaces > Operations Console > <select a perspective>

   If you are using the View Explorer, select a view from the drop-down list.

2. Select one or more configuration items, CI collections, or a combination of both from the View Explorer pane to use as an event filter. If you are using the CI Explorer, select the desired configuration item from the list, or select more items by using the Multiple Selection button.

   The Event Browser displays only the events that are related to a CI selected in the View Explorer or the CI Explorer.

   The events displayed in the Event Browser are limited to events associated with the selected CI. The Event browser title changes to show the CI selected.

   The selected CIs are displayed in the Event Browser status bar.

   Note The OMi perspectives are wired so that selecting a CI in the View Explorer or the CI Explorer disables the view selected in the Event Browser View Selector.

In this task, you learn how to display a list of configured event filters and apply one to the Event Browser.

To view a list of configured event filters:

1. Start a perspective containing an Event Browser and a View Explorer, for example, the Event Perspective or the Health Perspective:

   Workspaces > Operations Console > <select a perspective>

   Select a filter from the Filter list.

   Note If you have selected a view from the View list, the Event Browser is also filtered by the selected view.

2. From the Event Browser or the Closed Events Browser, click ... Manage event filters. The Manage Event Filters side panel opens containing a list of available event filters.

3. Select the event filter you want to apply.

4. Optional. Click Edit , modify the selected filter and click Save.

5. Click Close or outside the side panel to enable the filter.

   Enabling a filter updates the contents of the browser immediately.

6. If the selected filter does not display the results you require, redefine the selected event filter or select an alternative event filter.

   Note If you want to clear the selected filter, select <No Filter> from the filter selection boxes (views and filters). Deleting the filter selected in the Event Browser from the list of filters automatically applies no filter to the Event Browser.

In this task, you learn how to set up an event filter for the Event Browser or the Closed Events Browser using the Manage Event Filters side panel.

1. From the Event Browser or the Closed Events Browser, click ... Manage event filters. The Manage Event Filters side panel opens containing a list of available event filters.

2. Click New.

3. Enter a name and (optionally) a description for the new filter.

4. Click Add condition to add an expression to the filter.

   Start assembling a filter by choosing a category, for example Description, selecting the matching criteria, for example equals, and specifying the text string that the description should equal. Click OK to save the expression.

   

   
   

   Note There are two basic types of filters: string filters and prespecified filters.

   • Defining a string filter:

     Select a matching criteria for the selected property, for example contains, and specify a text string to search for.

     You can use the matching criteria matches and not matches to specify a regular expression that the filter compares with the events. For more information, see Regular expressions.

     Optional. Select case sensitive for the expression to differentiate between lower and upper case.

   • Defining a prespecified filter:

     Prespecified filters are used to select attributes which have a known range of values, for example, severities, priorities, lifecycle states, and dates.

     You can select one or more of the available options.

   For a list of all available filters and their definitions, see Event Filter elements.

5. Optional. Select an expression and click Wrap in operator to wrap the expression in an OR or AND operator. Add, or drag and drop other expressions underneath the operator to modify the expression dependency as required.

   

6. Repeat steps 4 to 5 to specify additional filtering components to the filter specification. You can also copy and paste filter expressions by pressing the Ctrl+C and Ctrl+V keys if you want to use a similar expression twice.

7. Optional. Enable Share this filter and specify if you want to share the filter with all other users or only users that have permission for a specific event filter category. For details, see Sharing Filters.

8. Click Save.

9. Optional. Select the newly created event filter and click Preview Matching Events. This opens a new Event Browser window, displaying the results of applying the newly defined filter. If the filter does not display the results you require, redefine the filter.

You can create, edit, and duplicate filters using the Event Filters side panel, available from the Event Browser.
Click ... Manage event filters to open the Event Filters UI.

Use these buttons to manage your event filters as follows:

	Refresh the list of event filters.
	Create a new event filter.
	Edit an existing event filter. You can also double-click an event filter to open the Edit Filter side panel.
	Duplicate an existing event filter. The Create Filter side panel opens with already predefined values, based on the filter you choose to duplicate.
	Delete an event filter. The filter will be permanently deleted for all users that the filter is shared with.
	Preview the events that will match the filter once it is applied in the Event Browser. The preview opens in a separate browser window.
	Restore a modified predefined filter to its original state.

Additionally, the following icons show you, at a glance, the current state of your filters:

	Unshared event filter. Only the user that created the filter, or the user that unshared a previously shared filter, can see and apply it.
	Shared event filter. Everyone that is specified in the Share this filter section can see and apply the filter, including the user that created the filter.
	Predefined filter. They cannot be deleted.
	Modified predefined filter.

When creating a filter, you can use the following keyboard shortcuts to copy, paste, cut, or move filter expressions: