Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Creating Incident Filters

 

This topic provides the details for creating basic and advanced filters and importing incident filters into Junos Space Service Now.

Creating a Basic Incident Filter

A basic incident filter uses the and and or predefined computational logic on the JMB attributes to filter a JMB. You can use the following JMB attributes to define a basic incident filter:

  • Event Synopsis

  • Description

  • Device IP Address

  • Event Occurred Date

  • Platform

  • Event Type

  • Entity

  • Device Name

For example, you can have a basic incident filter to filter JMBs that have the event type set to Daemon Crash and the event synopsis does not contain the term mgd.

To create a basic incident filter:

  1. In the Service Now navigation tree, click Administration > Incident Filters > Create Basic Filter.

    The Create Basic Filter page appears as shown in Figure 1.

    Figure 1: Create Basic Filter Page for Creating Basic Incident Filters
    Create Basic
Filter Page for Creating Basic Incident Filters
  2. In the Name text box, enter a name for the filter.

    An incident filter name can have a maximum of 255 alphanumeric characters. Special characters are not allowed.

  3. In the Action list, select an action for the filter:
    • Create Incident

    • Do Not Create an Incident

  4. For Term Criteria, select one of the following:
    • All—An incident is created or not created for a JMB (depending on the selected action) only when the JMB matches all the terms defined in the filter.

    • Any—An incident is created or not created for a JMB (depending on the selected action) when the JMB matches any of the terms defined in the filter.

  5. Select a JMB attribute from the list stating Select attribute type.

  6. Select a condition from the list stating Select attribute condition.

    An attribute condition defines the conditions such as words that can be present or not present in an event synopsis, the date before or after which the event occurs, or specific platforms. The conditions listed in this drop-down list differ for each attribute.

    For example: The Platform attribute has conditions such as includes, does not include, and starts with.

  7. Enter a value in the next text box for the attribute selected in step 5 and condition selected in step 6.

    For example, for the platform attribute, you can enter a value of SRX3400, EX3200, or MX960 so that the filter term is ”Platform includes SRX3400” or “Platform does not include SRX3400 ”.

    Note

    You can add only one value for an attribute and a condition in the text box.

  8. Click Add Term to add new filter terms and repeat steps 5 to 7.Tip

    Click Delete to delete a filter term.

  9. Click Submit to create the basic incident filter or click Cancel to cancel creating the filter.

    After you click Submit, Service now creates the filter and lists the newly created filter on the Incident Filters page.

Creating an Advanced Incident Filter

An advanced filter uses Perl scripts to define the filter terms and provides you the flexibility to define your own filtering logic. You can use the following JMB attributes to define a filter term in an advanced filter:

  • Event Synopsis

  • Description

  • Junos OS Version

  • Event Occurred Date

  • Platform

  • Event Type

  • Entity

  • Device Name

  • Device ID

Perl script is an example of an advanced incident filter:

Note

JMB attributes used in an advanced filter are assigned ARG values. For example , Device host name is assigned $ARGV[1]. Do not change the ARG value of a JMB attribute.

To create an advanced incident filter:

  1. In the Service Now navigation tree, click Administration > Incident Filters > Create Advanced Filter.

    The Create Advanced Filter page appears as shown in Figure 2.

    Figure 2: Create Advanced Filter Page for Creating Advanced Incident Filters
    Create Advanced
Filter Page for Creating Advanced Incident Filters
  2. In the Name text box, enter a name for the filter.

    An incident filter name can have a maximum of 255 alphanumeric characters. Special characters are not allowed.

  3. In the Action drop-down menu, select an action for the filter:
    • Create Incident

    • Do Not Create an Incident

  4. (Optional) if the Note section is not expanded, click the down arrow icon next to Note to expand the Note section. The Note section provides a sample Perl script for filtering JMBs.
  5. Click Browse and navigate to the Perl script on your local system.

    The Perl script should have the .pl extension.

  6. Click Upload to upload the Perl script.

    When the upload is complete, Service Now displays a message indicating that the file is uploaded successfully.

Importing Incident Filters to Service Now

Service Now allows you to import both advanced and basic incident filters. You can use the import option to restore incident filters from an XML file in Service Now after an upgrade.

Imported filters are assigned the next available order, that is, when there are two filters in Service Now with orders 1 and 2, the imported filters are assigned order from 3 onwards.

To import incident filters to Service Now:

  1. In the Service Now navigation tree, click Administration > Incident Filters > Import Incident Filters.

    The Import Incident Filters dialog box appears as shown in Figure 3.

    Figure 3: Import Incident Filters Dialog Box
    Import Incident
Filters Dialog Box
  2. Click Browse and navigate to locate the file to be imported on your local system.

    The file to be imported should be in the *.xml format.

  3. Select the file and click Upload to upload the incident filters.

    Service Now displays a message indicating that the file is uploaded successfully. You can view the uploaded filters on the Incident Filters page.