About Filters

Dexda has a common filter component that lets you define a query filter in a consistent way across functionality like charts, rules and action groups. When building queries and aggregations to limit results, you have a set of fields to choose from. Available fields vary depending on the selected data source – events, alerts, or insights, used as input.

The following describes the filter concept and available fields and operators. For information on how to create a filter, see Creating Filters.

Filter Conditions

Charts in dashboards, rules, and action groups all make use of the Filter component. The location of the filter on the page varies depending on the functionality. A filter can contain one or more conditions, where the filter condition is made up by the combination of field, operator and value. A filter has a default top level condition that cannot be removed, and you add conditions under this using AND or OR operators.

You build a filter condition as follows:

• Select a field to filter on, see Filter Fields.
• Select and operator (CONTAINS, EQUALS and so on), see Filter Operators.
• Enter a value.
• Create filter nodes using AND or OR operators if needed.

Dexda supports a number of filter conditions. The type of condition you select determines the values that you need to provide for the condition. The following describes operators and fields available when configuring filters for exampel for charts, rules, and action groups.

Filter Operators

The operators described in the following are available when building filters.

Parameter	Description
Contains	Substring match using the list of supplied values, where each value is interpreted as a string. Example: “nyk1245” matches “nyk1245”.
Not contains	Opposite of Contains.
In	Exact match using the list of supplied values, where each value can be a string or a number. Example: “nyk1245” matches “nyk1245”.
Not in	Opposite of In.
Empty	Field has no value…??
Not empty	Opposite of Empty.
Equals	Matches supplied value exactly.
Not equals	Opposite of Equals.
Greater than	Greater than supplied value, where value is a number.
Greater than equal	Greater than or equal to supplied value, where value is a number.
Less than	Less than supplied value, where value is a number.
Less than equal	Less than or equal to, supplied value, where value is a number.
Within	A time window relative to a specified time: Minutes is 6o secondsform now; Hour is 1 hour from now; Day is 24 hours from now; Month is a calendar month from now; Year is a calendar year from now.
Older than	A time window relative to a specified time, see Within.

Filter Fields

The fields described in the following are available when building filters.

Field	Description
_id	The ID of the database record.
# Alerts	Number of alerts, alert count.
# Events	Number of events, event count.
Actioned By
Additional Comments (Customer Visible)
Agent CI	Agent confiuration item.
Agent ID	ID of the agent.
Agent IP	IP address of the agent.
Agent Timestamp
Alert Key
Alert Key List
Application
Approval Group
Asset
Asset Tag
Assigned To	The assignee of an alert or insight.
Assigment group	The assigned group for an alert or insight.
Attributes
Caller
Category
Causal CI	The configuration item casuing an issue.
Checked in
Checked out
CI	Configuration item, for example a server or cloud instance.
Close notes
Contact Type
Comments
Company
Configuration Item
Correlation ID	The ID for the…??
Created Timestamp
Department
Description
Display Name
DNS Domain
Details
Earliest Event Timestamp
Environment
Escalation	The state of the workflow for an alert.
First Timestamp
Fully qualified domain name
Highest Severity	The highest severity level for an alert within a cluster…??
Impact
Impacted CIs
Install Status
Insight Key
Insight Key List
IP address	The IP address for the…??
Justification
Last Timestamp
Latest Event Timestamp
Lease Contract
Location
Lowest Severity	The lowest severity level for an alert in a cluster…??
MAC address	The MAC address for the…??
Maintenance schedule
Managed by
Manufacturer
ML Description
ML Severity
ML Source
ML State
ML Processor Timestamp
ML UI Result
Model category of component
Model ID
Model ID List
Model number
Monitor
Most recent discovery
Name
Number
Number of Rules Triggered	Number of rules triggered when…??
Object
Operational status
Operating system	Operating system associated with…??
Organisation ID
Original Key
Owned by
Parent
Permanent URL	The link to the insight in…??
Pipeline Timestamp
Priority
Region	The geographical region to be associated with a correlation model step…??
Requires verification
Resolution Code
RTO
Rule Key
Rule Name	The name of the rule applied to…??
Rule Value
Rules Ids Triggered List	List of rules applied to…??
Receiver ID
Receiver Timestamp
Serial number
ServiceNow Incident ID	ID of an associated ticket in ServiceNow.
ServiceNow Incident Priority	Priority of an associated ticket in ServiceNow.
ServiceNow Incident URL	Link to an associated ticket in ServiceNow.
ServiceNow Incident Runbook URL	Link to an associated automation runbook in ServiceNow.
Severity	Severity level for an item.
Short description
Source	The originating source for…??
Source Record
State	The state for an insight in the processing flow…?? See About Insights.
Status
Sub Category
Support Group
Supported by
Sys ID
System Class Name
Tags	Tags derived from the correlation model, summarizing associated item descriptions and relevant keywords. See Exploring Data.
Time
Timestamp
Updated Timestamp
Urgency
URL
Vendor
Version
Warranty expiration	Enriching information added to ticket from ServiceNow…??
Work Notes	Notes added to ticket in ServiceNow…??