Moogsoft Docs

Filter Search Data

You can search for specific alerts, Situations, and Impacted Services in Moogsoft AIOps using filters. The default filter views that you can access from the Workbench are Impacted Services, My Situations, Open Situations, My Alerts, and Open Alerts.

FillterSearchData1.JPG

There are two types of the filter: Basic Filter and Advanced Filter. Click the funnel filter icon to open the drop-down menu and switch between the filter types.

FillterSearchData2.JPG

Note

Moogsoft recommends that you use the Basic Filter in most cases but, if you want more flexibility or need to filter for something more complex, then use the Advanced Filter.

Create a Basic Filter

To use the Basic Filter:

  • Click in the "Filter" bar. A drop-down menu appears with available fields.

  • Select a field and any values as required; then click Apply or click away from the menu.

  • Repeat this for as many fields as you want to add to your filter.

  • Alternatively, type the name of the fields you want to apply to the filter.

  • Once you have entered one or more fields, click away from the menu to apply the filter.

FillterSearchData3.JPG
Alert Column Parameters

You can use the columns and operators displayed in the tables below in your Basic Filter:

Column Display Name

Associated Operators

Active Situations

IN

Alert Id

>

>=

<

<=

!=

=

Agent Name

MATCHES

Agent Host

MATCHES

Class

MATCHES

Count

>

>=

<

<=

!=

=

Description

MATCHES

Entropy

>

>=

<

<=

!=

=

External ID

MATCHES

First Event Time

>= AND <=

Host

MATCHES

Internal Last Event Time

>= AND <=

Last Change

>= AND <=

Last Event Time

>= AND <=

Manager

MATCHES

Owned By

IN

Severity

IN

Significance

IN

Situations

IN

Source ID

MATCHES

Status

IN

Type

MATCHES

Situation Column Parameters

Column Display Name

Associated Operators

Category

MATCHES

Created At

>= AND <=

Description

MATCHES

First Event Time

>= AND <=

ID

>

>=

<

<=

!=

=

Last Change

>= AND <=

Last Event Time

>= AND <=

Owned By

IN

Participants

>

>=

<

<=

!=

=

Process Impacted

CONTAINS

Scope Trend

>0

<=0

Services Impacted

CONTAINS

Sev Trend

>0

<=0

Severity

IN

Status

IN

Story

>

>=

<

<=

!=

=

Teams

IN

Total Alerts

>

>=

<

<=

!=

=

User Comments

>

>=

<

<=

!=

Create an Advanced Filter

The Advanced Filter is for complex queries and operates in a similar way to the Basic Filter but uses the Moogsoft filter query language which is based on SQL. For example, to show all Situations with a 'Severity' of 'Warning' and a 'Description' of 'SocketLam Sigalised', the correct syntax would be:

(Internal Severity IN ("Warning")) AND (Description MATCHES "SocketLam Sigalised")

advanced_filter.JPG

For more information on the query language syntax, see the tables of available operators and the examples below.

Pause Alerts and Situations

Click the Pause button to temporarily stop alerts or Situations being added to the Alert or Situation View.

Note

When paused, Moogsoft AIOps does not update the list with the latest data unless you apply a new filter which triggers a one-time load of data.

FillterSearchData5.JPG

After any edits have been made, the live feed of data can be reactivated again by clicking the Play button.

Advanced Filter Syntax

The Advanced Filter query syntax can be used to create more complex filters for Alerts and Situations. This syntax uses column display name parameters alongside common query operators used in filters. The column parameters and their associated operators are listed in the sections below.

Note

The Advanced Filter query syntax uses the display column names (those shown in the UI) rather than the database column names.

Alert Column Parameters

Column Display Name

Associated Operators

Active Situations

IN

CONTAINS

=

!=

Alert Id

>

>=

<

<=

!=

=

IN

Agent Name

MATCHES

=

!=

Agent Host

MATCHES

=

!=

Class

MATCHES

=

!=

Count

>

>=

<

<=

!=

=

Description

MATCHES

=

!=

Entropy

>

>=

<

<=

!=

=

External ID

MATCHES

=

!=

First Event Time

>

>=

<

<=

Host

MATCHES

=

!=

Internal Last Event Time

>

>=

<

<=

Last Change

>

>=

<

<=

Last Event Time

>

>=

<

<=

Manager

MATCHES

=

!=

Owned By

IN

=

!=

Severity

IN

=

!=

Significance

IN

=

!=

Situations

IN

CONTAINS

=

!=

Source ID

MATCHES

=

!=

Status

IN

=

!=

Type

MATCHES

=

!=

Situation Column Parameters

Column Display Name

Associated Operators

Category

MATCHES

=

!=

Created At

>

>=

<

<=

Description

MATCHES

=

!=

First Event Time

>

>=

<

<=

ID

>

>=

<

<=

!=

=

IN

Last Change

>

>=

<

<=

Last Event Time

>

>=

<

<=

Owned By

IN

=

!=

Participants

>

>=

<

<=

!=

=

Process Impacted

CONTAINS

=

!=

Scope Trend

>0

<=0

Services Impacted

CONTAINS

=

!=

Sev Trend

>0

<=0

Severity

IN

=

!=

Status

IN

=

!=

Story

>

>=

<

<=

!=

=

Teams

IN

CONTAINS

=

!=

Total Alerts

>

>=

<

<=

!=

=

User Comments

>

>=

<

<=

!=

The associated operators are described in the tables below.

Comparison Operators

Operator

Description

Example

Result

=

Equal to

Alert ID = 120

Alerts which have an Alert Id of 120

<>

Not equal to

Alert ID <> 120

Alerts which do not have an Alert Id of 120

>

Greater than

ID > 100

Situations where the Situation Id is greater than 100

<

Less than

ID < 100

Situations where the Situation Id is less than 100

>=

Greater than or equal to

ID >= 100

Situations where the Situation Id is greater than or equal to 100

<=

Less than or equal to

ID <= 100

Situations where the Situation Id is less than or equal to 10

Literal Operators

Operator

Description

Example

Result

' ' or " "

Single or double quotations indicate the start and end of a string value

description = "test"

Situations with 'test' as the description

( )

List of items

teams = (1,2,3)

Situations that are assigned to teams 1, 2 and 3 (and only 1, 2 and 3)

Logical Operators

Operator

Description

Example

Result

AND

AND allows the existence of multiple conditions

ID < 100 AND queue=4

Situations where the Situation Id is less than 100 and the queue is 4 (both must be true)

OR

OR is used to combine multiple conditions

ID < 100 OR queue=4

Situations where either the Situation Id is less than 100 or the queue is 4

NOT

Reverses the meaning of the logical operator used. E.g. NOT IN, IS NOT NULL etc.

queue NOT IN (1,2,3)

Situations where the queue is not 1, 2 or 3

Other Operators

Operator

Description

Example

Result

IN

Compares a value to a list of specified values

queue IN (1,2,3)

Situations where the queue is 1, 2 or 3

IS NULL

Compares with a NULL value

queue IS NULL

Situations where there is no queue

MATCHES

Matches the regular expression

description MATCHES "test"

Situations where the description matches the regular expression "test"

ANY_MATCH

Any matches of the regular expression

teams ANY_MATCH "team[0-9]+"

Situations where one of the teams names match the regular expression team[0-9]+

ALL_MATCH

All matches of the regular expression

teams ALL_MATCH "team[0-9]+"

Situations where all of teams names match the regular expression team[0-9]+

CONTAINS

Contains the value

teams CONTAINS (1,2,3)

Situations where the teams contain 1, 2 and 3

Creating an Advanced Filter

When creating an Advanced Filter, it should contain at least one column name, an associated operator, and a value. As a general rule, the column name should always be to the left of the operator.

If the column name or the value contains a space, it needs to be surrounded by single or double quotation marks (both " " and ' ' are accepted). This applies to columns such as External ID, Last Event Time, Last Change, Scope Trend etc. For example, 'External ID' MATCHES 01 or "External ID" MATCHES 01 are both valid.

Column names are case insensitive but the values are case sensitive. For example, 'severity' = 'Critical' is valid but 'severity' = 'critical' is not.

If you want to create a filter where the owner is empty, enter 'Owned By' = 'Moog'.

If the syntax is incorrect or invalid then the filter bar will flash, see screenshot below:

FillterSearchData6.JPG

For reference, please see the examples and screenshots displayed below.

Filter on Custom Info Fields

You can filter on custom info columns in Alert and Situation Views. The syntax for advanced filters uses the CONTAINS keyword. The following is an example for a custom info column named "servers.kingston":

custom_info.servers.kingston CONTAINS "kngstn::webserver::HR"

You must use full matching, rather than partial matching, which means that the whole value in the filter must appear in the list. For example, the above filter requires the list to have a "kngstn::webserver::HR" element. It does not, for example, match "kngstn::webserver".

Quotes are optional for both strings and number values. Note that no brackets are allowed around the filter value.

For this feature to work, the custom info column (in this example, "servers.kingston") must be added as a filterable column. This can be done in the UI, under System Settings > Alert / Situation Columns, or via the utilities: moog_add_alert_custom_info_field and moog_add_situation_custom_info_field. The column type must be a list (in the UI) or JSON (via a utility).

Advanced Filter Examples

Example 1

Severity = 'Minor' AND Description = 'Web Situation'

In this example, the filter shows all alerts with 'Minor' severity and with the description 'Web Situation':

FillterSearchData7.JPG

Example 2

Severity = 'Critical' OR (Severity = 'Major' AND description = 'SocketLam Sigalised')

In this example, the filter shows all alerts with 'Critical' severity, or 'Major' severity and with a type of 'SocketLam Sigalised':

FillterSearchData8.JPG

Example 3

Type MATCHES 'Anomalyflag' AND Count = 1

In this example, the filter shows all alerts which match the 'Anomalyflag' type and have a count of 1:

FillterSearchData9.JPG