Hello,

Usually in Windows event policies this is defined in the policy. 

This being the related ci:

And object here:

Normally, you would need to change the policy condition.

Thanks.

Actually i need to map below fields from the event log contents (from "original data" )

did you try: <$MSG_OBJECT>

tried both <$MSG_ObjectName> and <$MSG_OBJECT> , but still no luck.

Hello,

I'm a bit confused - so you want the object field to show the hostname, or the Ci type or something else?  These are set in the policy using policy variables (see https://docs.microfocus.com/doc/Operations_Bridge_Manager/2023.05/OmucptWindowsEventloghtml#Policy_variables).

I think you need to check this  CI Resolution - Operations Bridge Manager (microfocus.com)

Both fields are resolved and not directly mappable.

If <$MSG_ObjectName> and <$MSG_OBJECT> are not working  may be  running the 

/opt/HP/BSM/opr/support/opr-support-utils.sh -trh -hint <pattern>   

would provide clues why its not working..

Hi Ducan

can you explain me on what basis Related CI is defined in the above screen shot by comparing it with the event log description, so that similar way we can replicate the same in our scenario.

Hello,

The only relevence is that it's an example.  You might add BMC7896_78 (however this is defined) to the related CI field.  Without knowing your policy, it's hard to guess.  The hostname is usually a varible (e.g. MSG_NODE_NAME) or can be defined as a variable.

any working reference for event log policy so that i can refer. OBM documents does not help as there is no example or clear guidance in them.