levani Super Contributor.
Super Contributor.
1032 views

Base event fields to correlated event without aggregation

Jump to solution

Hi. I have a question on transferring the base event field to Correlated event in scenario when I do not have any aggregation as I always have only one event.

In more details I have a rule that catches the expired event from the Active list. As you know when record expires in Active list internal event is generated that has details of what was removed from active list in deviceCustomString6. So when my Rule detects expired event (always one with no aggregation) it creates Correlated event. I need to add data that is located in the deviceCustomString6 of base event into the correlated event let say to deviceCustomString2. I have tried with deviceCustomString2=$deviceCustomString6 but it does not work. I understood the reason why but I am not able to understand if there is any way, not to use aggregation.

Thanks

Labels (3)
Tags (3)
0 Likes
1 Solution

Accepted Solutions
Highlighted
pratikp Absent Member.
Absent Member.

Re: Base event fields to correlated event without aggregation

Jump to solution

Hi Levan,

As you have created rule which looks for only one base event. Then its achievable.

As mentioned below, Just add deviceCustomString6 in "aggregate only if these fields are identical" which you want to be there in correlate rule

After this you should able to see data in device custom string6 data in correlated rule in same column.

If this is helping you, kindly mark my response as helpful so that others can make use of it.

Regards,

Pratik

0 Likes
4 Replies
Highlighted
pratikp Absent Member.
Absent Member.

Re: Base event fields to correlated event without aggregation

Jump to solution

Hi Levan,

As you have created rule which looks for only one base event. Then its achievable.

As mentioned below, Just add deviceCustomString6 in "aggregate only if these fields are identical" which you want to be there in correlate rule

After this you should able to see data in device custom string6 data in correlated rule in same column.

If this is helping you, kindly mark my response as helpful so that others can make use of it.

Regards,

Pratik

0 Likes
levani Super Contributor.
Super Contributor.

Re: Base event fields to correlated event without aggregation

Jump to solution

Thanks. It worked. So again, you always need to add the filed to aggregate to be able to the data from the base event.

0 Likes
scott.conlon@hp Absent Member.
Absent Member.

Re: Base event fields to correlated event without aggregation

Jump to solution

Hi, so do I understand this correctly??

If you add fields in the "aggregate only if these fields are identical" area, then those fields will automatically be populated in your correlated event?

This means for your example above you can now have a notification that says $deviceCustomString6, and in your email notification the base event for deviceCustomString6 will be present in the email.

But if you don't put it in  "aggregate only if these fields are identical" your notification will probably be blank because nothing is in that field in the correlated event.

Does that sound right?

0 Likes
levani Super Contributor.
Super Contributor.

Re: Base event fields to correlated event without aggregation

Jump to solution

Yes, that's right. Data from base event are transferred to internal event only in case when those fields are in aggregation.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.