Highlighted
karl2k1 Absent Member.
Absent Member.
549 views

How can I make a condition to look for differences in time

I have a rule that is meant to fire when an AD account is locked out.  Sometimes our events show a gap in time between end time and manager receipt time, anywhere from 5 minutes to several hours.  Not quite sure why this occurs to begin with.

I'd like to have a condition similar to the following, but having issues:

NOT Manager Receipt Time > End Time + 5m

I can make a time difference variable, but I am not allowed to use the > operator

Labels (1)
Tags (2)
0 Likes
Reply
14 Replies
chenselein1 Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

Hi Karl,

you are right on: Use a TimeDifference Variable - why are you not allowed to use <> here?

0 Likes
Reply
karl2k1 Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

I thought it would be that simple, but I only get the following options for a variable:
=
!=
In
Contains
StartsWith
EndsWith
Like
Is

I do not get the option of >,<, >=, or <=.  Its almost like it thinks of the variable as a string instead of an integer

0 Likes
Reply
sorinodc Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

Karl,

You have to use a local variable (as Cristoph mentioned) that automatically calculates the time difference for you. Please see below how you can easily do that.

1.JPG2.jpg

3.JPG

4.jpg

5.jpg

Good luck!

0 Likes
Reply
karl2k1 Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

followed those exact steps, still no option for those boolean expressions

variable.jpg

0 Likes
Reply
karl2k1 Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

Any ideas?  I'll ask HP, most likely they will refer me to HP professional services

0 Likes
Reply
Outstanding Contributor.. douglas.baker@h1 Outstanding Contributor..
Outstanding Contributor..

Re: How can I make a condition to look for differences in time

All of the examples are right. When you want to include the 'Local Variable' in the Active Channel as a Filter then during the Filter selection process the Conditions of "=", "!=", "<",.... are exposed for your selection. Choose one, e.g. 'timedifference > 60.0' would show those events where your 'time difference in seconds Local Variable' was more that 60.0 seconds.

Tune from there.

Thank you,

Doug


0 Likes
Reply
karl2k1 Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

Thanks for the reply doug, the problem is that those expressions are not available from the drop down, as indicated by my screenshot on the 26th.  I created a ticket with HP, we'll see what happens

0 Likes
Reply
karl2k1 Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

This is the response I got on 5/3 from HP support:

I tested the scenario in my test system and created a timedifference variable to show time difference between ET and MRT. I was able to reproduce the issue and I also could not see >,<, >=, or <= options. I got those options for all other variables except the timedifference variable. I will have to check if this is a bug or if it is something else. I will update you very soon. Thanks!

Regards,

Srujana

0 Likes
Reply
chenselein1 Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

This is quite interesting. I have been working with this variable and >< in many Cases and it always worked - on what ESM Version are you Karl?

0 Likes
Reply
karl2k1 Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

This is the Express 3 with CORR, using the 5.1.0.1281.3 console

0 Likes
Reply
sorinodc Absent Member.
Absent Member.

Re: How can I make a condition to look for differences in time

I was also testing it on the Express 3 CORR, but I don`t remember exact version of the console.

Do let us know once you have any updates from HP Support.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.