correlation composer alarm signature
I am trying to use the correlation composer and have most of it done except for the alarm signature. I want to alarm on a CMA that is blank. I have added the CMA into /opt/OV/bin/CO.conf.
I have set the alarm signature
This does not work though.
Why don't you use Filed: CMA_TEAM_NAME
If your requirement blank isn't matched, you could try "<0*>"
it maches a string of 0 arbitrary characters (including separators)
Not sure where CMA_TEAM_NAME came into this.
Setting the alarm signature to "<0*>" (with quotes) did not work either.
Many of my alerts come in with the CMA named ENVIRONMENT filled in.
It is those that are not filled in that I want the correlation composer to run for.
I am trying to have a CMA that will indicate the environment that the alert pertains to.
For example "PRD", "PRD1", "UAT", "UAT1", "UAT2", "DEV", "TEST", "TST", "TRN"
So for now I have done a "not in list" using that list however that means I have to maintain that list. A blank field would of been a better solution.