Highlighted
Honored Contributor.
Honored Contributor.
781 views

ESM - Logical Operator Question

Jump to solution

Hello,

Hopefully, this is a quick one to answer.

I am rewriting a rule in the console.

the rule is as follows

Event1

OR

AND

Matches Filter X

Device Custom String1 = 1

AND

Matches Filter Y

Device Custom String1 = 1

This equates to in the summary tab:

Matches filter X AND Device Custom String1 = 1 OR matches filter Y AND Device Custom String1 =1

What I don't understand is why this is an invalid statement.

I do not want to match these events so a matching join won't be applicable either.

Any light you can shed on the logic and where I'm falling down would be much appreciated.

Regards

Oliver

 

Tags (2)
0 Likes
1 Solution

Accepted Solutions
Highlighted
Honored Contributor.
Honored Contributor.

Problem Solved!!

You cannot do an "Condition 1 AND Condition 2" OR "Contidion 3 AND Condition 4" statement if Condition 1 and 3 are filters.

If the conditions from the filters are specified indervidually in the two statements then this will match

View solution in original post

0 Likes
2 Replies
Highlighted
Honored Contributor.
Honored Contributor.

Problem Solved!!

You cannot do an "Condition 1 AND Condition 2" OR "Contidion 3 AND Condition 4" statement if Condition 1 and 3 are filters.

If the conditions from the filters are specified indervidually in the two statements then this will match

View solution in original post

0 Likes
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

I have seen this with activelist conditions as well in certain scenarios. What you can normally do is add the filter under it's own AND. So the event would be something like:

 

Event1
   OR
Device Custom String1 = 1
AND
Matches Filter X
Device Custom String1 = 1
AND
Matches Filter Y

Not really clean, but it should work if you want to match filters instead of utilizing the conditions themself.

 

 

 

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.