Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Navigation
Guide That Contains This Content
[+] Expand All
[-] Collapse All

    Creating Incident Filters

    This topic provides the details for creating basic and advanced filters and importing incident filters into Junos Space Service Now.

    Creating a Basic Incident Filter

    A basic incident filter uses the the and and or predefined computational logic on the JMB attributes to filter a JMB. You can use the following JMB attributes to define a basic incident filter:

    • Event Synopsis
    • Description
    • Device IP Address
    • Event Occurred Date
    • Platform
    • Event Type
    • Entity
    • Device Name

    For example, you can have a basic incident filter to filter JMBs with event type as Daemon Crash and event synopsis does not include the term mgd.

    To create a basic incident filter:

    1. In the Service Now navigation tree, click Administration > Incident Filters > Create Basic Filter.

      The Create Basic Filter page appears as shown in Figure 1.

      Figure 1: Create Basic Filter Page for Creating Basic Incident Filters

      Create Basic
Filter Page for Creating Basic Incident Filters
    2. In the Name text box, enter a name for the filter.

      An incident filter name can have a maximum of 255 alphanumeric characters. Special characters are not allowed.

    3. In the Action drop-down menu, select an action for the filter:
      • Create Incident
      • Do Not Create an Incident
    4. For Term Criteria, click one of the following:
      • All—An incident is created or not created for a JMB (depending on the selected action) only when the JMB matches all the terms defined in the filter.
      • Any—An incident is created or not created for a JMB (depending on the selected action) when the JMB matches any of the terms defined in the filter.
    5. Select a JMB attribute from the drop-down menu stating Select an attribute type.

    6. Select a condition from the drop-down menu stating Select attribute condition.

      An attribute condition defines the conditions such as words that can be present or not present in an event synopsis, the date before or after which the event should occur, or specific platforms. The conditions listed in this drop-down menu differ for each attribute.

      For example: The Platform attribute has conditions such as includes, does not include, and starts with.

    7. Enter a value in the next text box for the attribute selected in step 5 and condition selected in step 6.

      For example, for the platform attribute, you can enter a value of SRX3400, EX3200, or MX960 so that the filter term is ”Platform includes SRX3400” or “Platform does not include SRX3400 ”.

      Note: You can add only one value for an attribute and a condition in the text box.

    8. Click Add Term to add new filter terms and repeat steps 5 to 7.
    9. (Optional) Click Delete to delete a filter term.
    10. Click Submit to create the basic incident filter or click Cancel to cancel creating the filter.

      The filter is created and listed on the Incident Filters page.

    Creating an Advanced Incident Filter

    An advanced filter uses Perl scripts to define the filter terms, thereby, providing you the flexibility to define your own filtering logic. You can use the following JMB attributes to define a filter term in an advanced filter:

    • Event Synopsis
    • Description
    • Junos OS Version
    • Event Occurred Date
    • Platform
    • Event Type
    • Entity
    • Device Name
    • Device ID

    Perl script is an example of an advanced incident filter:

    Note: JMB attributes used in an advanced filter are assigned ARG values. For example , Device host name is assigned $ARGV[1]. Do not change the ARG value of a JMB attribute.

    To create an advanced incident filter:

    1. In the Service Now navigation tree, click Administration > Incident Filters > Create Advanced Filter.

      The Create Advanced Filter page appears as shown in Figure 2.

      Figure 2: Create Advanced Filter Page for Creating Advanced Incident Filters

      Create Advanced
Filter Page for Creating Advanced Incident Filters
    2. In the Name text box, enter a name for the filter.

      An incident filter name can have a maximum of 255 alphanumeric characters. Special characters are not allowed.

    3. In the Action drop-down menu, select an action for the filter:
      • Create Incident
      • Do Not Create an Incident
    4. (Optional) if the Note section is not expanded, click the icon next to Note to expand it. The Note section provides a sample Perl script for filtering JMBs.
    5. Click Browse to locate the Perl script on your local system.

      The Perl script should have the extension .pl.

    6. Click Upload to upload the Perl script.

      A message indicating that the file is uploaded successfully is displayed.

    Importing Incident Filters to Service Now

    Service Now allows you to import both advanced and basic incident filters. You can use the import option to restore incident filters in Service Now after an upgrade.

    Imported filters are assigned the next available order, that is, there are two filters in Service Now with orders 1 and 2, the imported filters are assigned order from 3 onwards.

    To import incident filters to Service Now:

    1. In the Service Now navigation tree, click Administration > Incident Filters > Import Advanced Filters.

      The import Incident Filters dialog box appears as shown in Figure 3.

      Figure 3: Import Incident Filters Dialog Box

      Import Incident
Filters Dialog Box
    2. Click Browse to locate the file to be imported on your local system.

      The file to be imported should be in the *.xml format.

    3. Click Upload to upload the incident filters.

      A message indicating that the file is uploaded successfully is displayed. You can view the uploaded filters on the Incident Filters page.

    Modified: 2017-06-14