david_auquiere Absent Member.
Absent Member.
460 views

Search on VendorOutcomeCode (voc)

Hello, is there a way for searching on voc field. I have tried different solution like voc:0x1F; voc:x1F; voc:0x1f; voc:"0x1F";voc:'0x1F' but it is not working...Any idea how to search on that string field?

Thanks
0 Likes
3 Replies
Knowledge Partner
Knowledge Partner

Re: Search on VendorOutcomeCode (voc)

If you are in the main view where you can search for events, are you able
to click 'Show More' (or whatever that link is) to see the whole event,
and if so do you see the field there? If so, click on it and it will add
that to the search for you.

I want to say you can search on this, as I know I have created reports for
clients based on things that came from that (e.g. HTTP 5xx or 4xx errors
from Apache Tomcat, or AWS services, or whatever), but maybe I did the
severity mapping in the collector and then built a search or report around
that; if that's an option for you, it may work as well.

Could you elaborate on what you're trying to find, and why? Have a
screenshot of the events with that field which you can post somewhere, or
an export of the event in text form (even better)?

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.
0 Likes
ScorpionSting Absent Member.
Absent Member.

Re: Search on VendorOutcomeCode (voc)

ab;2499473 wrote:
If you are in the main view where you can search for events, are you able
to click 'Show More' (or whatever that link is) to see the whole event,
and if so do you see the field there? If so, click on it and it will add
that to the search for you.

I want to say you can search on this, as I know I have created reports for
clients based on things that came from that (e.g. HTTP 5xx or 4xx errors
from Apache Tomcat, or AWS services, or whatever), but maybe I did the
severity mapping in the collector and then built a search or report around
that; if that's an option for you, it may work as well.

Could you elaborate on what you're trying to find, and why? Have a
screenshot of the events with that field which you can post somewhere, or
an export of the event in text form (even better)?

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.



(voc:"403")


Works for me... also used to have correlations that worked with


(e.VendorOutcomeCode = "404")


Sounds like the value you're searching for (in the period you're searching for), doesn't match actual values.

voc doesn't show with an event's "more", only in "all" (which doesn't have filter-selectable items)....will not even show in "refine" fields....so have to use lucene query

Visit my Website for links to Cool Solution articles.
0 Likes
david_auquiere Absent Member.
Absent Member.

Re: Search on VendorOutcomeCode (voc)

Sorry for the delay...i retry the filter and it is surely an error from my side with brackets...(rv40:4769) AND (voc:0x20) is working...

Thanks for our help...

david
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.