About Filters

LM Dexda has a common filter component that lets you define a query filter in a consistent way across functionality like charts, rules, and action groups. When building queries and aggregations to limit results, you have a set of fields to choose from. Available fields vary depending on the input from the selected data source – events, alerts, or insights.

This article describes the filter concept and available fields and operators. For information on how to create a filter, see Creating Filters.

Filter Conditions

Charts in dashboards, rules, and action groups all make use of the Filter component. The location of the filter on the page varies depending on the functionality. A filter can contain one or more conditions, where the filter condition is defined by the combination of field, operator and value. A filter has a default top level condition that cannot be removed, and you add conditions under this using AND or OR operators.

You build a filter condition as follows:

1. Select a field to filter on. For more information, see Filter Fields.
2. Select an operator (CONTAINS, EQUALS and so on). For more information, see Filter Operators.
3. Enter a value.
4. Create filter nodes using AND or OR operators if needed.

Filter Operators

The type of filter condition you select determines the values that you need to provide for the condition. The following describes operators and fields available when configuring filters for example for charts, rules, and action groups.

Parameter	Description
Contains	Substring match using the list of supplied values, where each value is interpreted as a string. Example: “nyk1245” matches “nyk1245”.
Not contains	Opposite of Contains.
In	Exact match using the list of supplied values, where each value can be a string or a number. Example: “nyk1245” matches “nyk1245”.
Not in	Opposite of In.
Empty	Field has no value.
Not empty	Opposite of Empty.
Equals	Matches supplied value exactly.
Not equals	Opposite of Equals.
Greater than	Greater than supplied value, where value is a number.
Greater than equal	Greater than or equal to supplied value, where value is a number.
Less than	Less than supplied value, where value is a number.
Less than equal	Less than or equal to, supplied value, where value is a number.
Within	A time window relative to a specified time: Minutes is 60 secondsform now; Hour is 1 hour from now; Day is 24 hours from now; Month is a calendar month from now; Year is a calendar year from now.
Older than	A time window relative to a specified time, see Within.

Filter Fields

The fields described in the following are available when building filters.

Field	Description
_id	The ID of the database record.
# Alerts	Number of alerts, alert count.
# Events	Number of events, event count.
Actioned By
Additional Comments (Customer Visible)
Agent CI	Agent confiuration item.
Agent ID	ID of the agent.
Agent IP	IP address of the agent.
Agent Timestamp
Alert Key
Alert Key List
Application
Approval Group
Asset
Asset Tag
Assigned To	The assignee of an alert or insight.
Assigment group	The assigned group for an alert or insight.
Attributes
Caller
Category
Causal CI	The configuration item casuing an issue.
Checked in
Checked out
CI	Configuration item, for example a server or cloud instance.
Close notes
Contact Type
Comments
Company
Configuration Item
Correlation ID
Created Timestamp
Department
Description
Display Name
DNS Domain
Details
Earliest Event Timestamp
Environment
Escalation	The state of the workflow for an alert.
First Timestamp
Fully qualified domain name
Highest Severity	The highest severity level for an alert within a cluster.
Impact
Impacted CIs
Install Status
Insight Key
Insight Key List
IP address
Justification
Last Timestamp
Latest Event Timestamp
Lease Contract
Location
Lowest Severity	The lowest severity level for an alert in a cluster.
MAC address
Maintenance schedule
Managed by
Manufacturer
ML Description
ML Severity
ML Source
ML State
ML Processor Timestamp
ML UI Result
Model category of component
Model ID
Model ID List
Model number
Monitor
Most recent discovery
Name
Number
Number of Rules Triggered
Object
Operational status
Operating system	Operating system associated with a resource.
Organisation ID
Original Key
Owned by
Parent
Permanent URL
Pipeline Timestamp
Priority
Region
Requires verification
Resolution Code
RTO
Rule Key
Rule Name	The name of the rule applied.
Rule Value
Rules Ids Triggered List
Receiver ID
Receiver Timestamp
Serial number
ServiceNow Incident ID	ID of an associated ticket in ServiceNow.
ServiceNow Incident Priority	Priority of an associated ticket in ServiceNow.
ServiceNow Incident URL	Link to an associated ticket in ServiceNow.
ServiceNow Incident Runbook URL	Link to an associated automation runbook in ServiceNow.
Severity	Severity level for an item.
Short description
Source
Source Record
State	The state for an insight in the processing flow. See About Insights.
Status
Sub Category
Support Group
Supported by
Sys ID
System Class Name
Tags	Tags derived from the correlation model, summarizing associated item descriptions and relevant keywords. See Exploring Data.
Time
Timestamp
Updated Timestamp
Urgency
URL
Vendor
Version
Warranty expiration	Enriching information added to ticket from ServiceNow.
Work Notes	Notes added to ticket in ServiceNow.