Use > Use the Event Browser > Event Filters > Filtering methods

Filtering methods

Large IT environments naturally create a large number of events. All active events are displayed in the Event Browser and maintaining a clear overview of the events that require attention becomes increasingly difficult as the number of received events increases.

You can filter the contents of the Event Browser, for example, in the Event and Health Perspectives (or perspective containing an Event Browser and the View Explorer), according to a combination, where available, of the following selections:

  • Views

    Views are used to group configuration items into logical sets. Selecting a view, the Event Browser only displays events that are related to the CIs specified in the selected view.

  • Configuration Items

    Selecting one or more CIs from the CI tree only displays events in the Event Browser that are related to the selected CIs.

  • Configuration Item Collection

    Selecting a CI Collection from the CI tree only displays events in the Event Browser that are related to the CIs that are contained within the selected collection.

  • Event Filters

    Applying an event filter enables you to limit the type of events displayed in the Event Browser by defining rules that filter events according to criteria such as severity, lifecycle state, or assignment (ownership).

    In the Event Browser, event filters can be shared so that all users have access to them. To be able to share filters, you must have appropriate permissions. For details, see How to Set Permissions. Shared filters are required by Monitoring Dashboard widgets.

  • Quick Filters

    The Event Browser status bar displays a summary of the number of events by severity and assignment to individual users or user groups. Each status bar severity item is also a quick filter that can be selected to display the events that correspond to the selected severity. Multiple items can be selected to display all events with two or more severities.

  • Search

    Events can also be filtered by a search string. Entered text string is used to search the text displayed in the Event Browser and display only the events containing the specified string. Clearing the field displays all events again.

By applying a combination of the available filtering methods, you can display just the most important events that you are responsible for. It is possible to create a view to display a CI tree list tailored to the responsibilities of an operator. Operators can then select a CI from the CI tree and be shown all related events. Alternatively, operators can define filters to, for example, show only events labeled as Critical and Major. Combining the selection of a CI and applying the same filter displays all events labeled as Critical and Major for the select CI.