jklein Valued Contributor.
Valued Contributor.

Time Parameter Used in Rule Aggregation?

We're trying to create a join rule that will fire if both events happen within a 10 second time frame.  The conditions are fine on their own in an Active Channel.  The rule won't fire because there's a slight delay from the Windows Unified connector (load issue) and the second event would roll in >10 seconds, when in reality the events happen at the same time.  We'd like to be able to first, verify the type of time used in aggregation, and second, know if there's a way to specify the type of time used to say, device receipt/end time.  Anyone ran into this before?

Labels (2)
2 Replies
balahasan.v1 Acclaimed Contributor.
Acclaimed Contributor.

Re: Time Parameter Used in Rule Aggregation?

Hi Jason Klein,

I Guess u can try using Time Functions in Variables and call those Variables in Aggregation (Difference in Hours,mins,secs from Both End Time/Manager Receipt Time).

I Hope this is somewhat helpful for u.

Please revert in case any Queries.

Thanks and Regards,


New Member.

Re: Time Parameter Used in Rule Aggregation?

Correlation is based on end-time.


The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.