Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Example: Representing the Correlating Event in an Event Policy

 

In the show interfaces {$$.interface-name} command, the value of the interface-name attribute of event e1, e2, or e3 is substituted for the {$$.interface-name} variable.

In the show interfaces {$e4.interface-name} command, the value of the interface-name attribute of the most recent e4 event is substituted for the {$e4.interface-name} variable.

In the show interfaces {$*.interface-name} command, the value of the interface-name attribute of the most recent e4, e5, or e6 event is substituted for the {$*.interface-name} variable. If one of e4, e5, or e6 occurs within 60 seconds of e1, e2, or e3, the value of the interface-name attribute for that correlating event (e4, e5, or e6) is substituted for the {$*.interface-name} variable. If the correlating event does not have an interface-name attribute, the software does not execute the show interfaces {$*.interface-name} command.

If both e4 and e5 occur within 60 seconds of e1, then the value of the interface-name attribute for e4 is substituted for the {$*.interface-name} variable. This is because the event process (eventd) searches for correlating events in sequential order as configured in the within statement. In this case, the order is e4 > e5 > e6.