correlation composer alarm signature

[tws_2]

Greetings

I am trying to use the correlation composer and have most of it done except for the alarm signature. I want to alarm on a CMA that is blank. I have added the CMA into /opt/OV/bin/CO.conf.

I have set the alarm signature

Field: ENVIRONMENT

Operator: matches

Value: ""

This does not work though.

[TamNP]

Xin chào,

Why don't you use Filed: CMA_TEAM_NAME
If your requirement blank isn't matched, you could try "<0*>"
it maches a string of 0 arbitrary characters (including separators)

[tws_2]

Not sure where CMA_TEAM_NAME came into this.

Setting the alarm signature to "<0*>" (with quotes) did not work either.

Many of my alerts come in with the CMA named ENVIRONMENT filled in.

It is those that are not filled in that I want the correlation composer to run for.

[Goran Koruga]

Hello.

Which product are you using?  There may be other/simpler ways of achieving what you want.

Regards,

    Goran

[tws_2]

I am trying to have a CMA that will indicate the environment that the alert pertains to.

For example "PRD", "PRD1", "UAT", "UAT1", "UAT2", "DEV", "TEST", "TST", "TRN"

So for now I have done a "not in list" using that list however that means I have to maintain that list. A blank field would of been a better solution.