|
|
This chapter contains the following sections:
Filters can be used to define a query to the Cisco Info Server's internal tables in order to select information. The queries are based on the Cisco Info Server SQL.
The Filter Builder is a standard window throughout Cisco Info Center, and is used for loading, saving, and editing filters. Many tools within Cisco Info Center use filter files.
You can start the Filter Builder in several ways:
Figure 3-1 shows the Filter Builder window launched from the Conductor.
When you start the Filter Builder from a tool, for example, the Event List, an Apply button is also available at the bottom of the window.
To create a filter, specify a name for the filter in the Filter Name field. This name is used in menus in the Event List and Objective View.
A filter is made up of elements, as described in the following sections.
A filter is made up of the following elements:
The elements are displayed as blocks on the filter display and arranged in a tree showing how the elements relate.
When you select an element, the field, operator, and value attributes can be edited.
To create a condition element in the filter display:
1. Click on the Condition button. Condition elements are displayed in blue. The element inspector displays options buttons.
2. Select a field from the Column options button. For example, select Acknowledged.
3. Select an operator from the Operator options button.
4. Specify a comparison value.
The following sections describe in more detail how to edit the field, operator, and value attributes in the element inspector.
Click on the Column options button to display a menu of all the available fields to be used in the comparison. The Filter Builder automatically determines which fields are available. By default, the list contains names of the fields in the status table of the alerts database. There are situations where this list is different and these special cases are discussed later.
Click on the Operator options button to display the comparison operation to be used for the condition element. The range of comparisons available is determined by the field selected on the Column options button. Some comparisons are unavailable for certain fields. For example, it is not possible to have a LIKE operation on a numeric field such as Severity.
The Value field is sensitive to the type of data required. Three data types exist:
You can also specify a list of values, rather than a single value, using In or Not In. These types are described in the following sections.
String values are displayed as text fields. Specify a string in the field; surrounding quotation marks are not required. For example, Figure 3-2 shows the element inspector for the Agent field.
Some characters in the string may be escaped with a back slash (\) in the SQL text where they would otherwise have unintended effects on the operation of the filter. For example, single and double quotation marks are automatically escaped.
For integer values, the value field is split into three parts: an Options button, a numeric field, and a pair of arrow buttons. Figure 3-3 shows the element inspector for the Severity field.
The Options button is only active when a numeric field has a number of conversions set up for it. Where there are no conversions available, the options button is grayed out.
For example, the Severity field is stored internally as an integer value, however, it has a set of conversions to map those numbers to various severity strings (0 means Closed, 5 means Critical). Where conversions such as this exist for a field, the string names are displayed in the Options button. Select an entry on the Options button to place the numeric value in the numeric field next to the Options button. When you are setting a comparison with Severity and select Major on the Options button, a 4 is entered into the numeric field.
You can also specify a numeric value directly into the text field. Click on the arrow buttons to increment and decrement the numeric value. The value used is the value in the text field.
Date and time value fields have two modes of operation:
Figure 3-4 shows the element inspector for the FirstOccurrence field in absolute mode.
In absolute mode, the six fields that follow the Options button represent day, month, year, hour, minutes, and seconds. You can specify a date directly into these fields or increment and decrement the values by using the arrow buttons to the right of each field. The date and time displayed is always initialized to the current date when an element is created.
Figure 3-5 shows the element inspector for the FirstOccurrence field in relative mode.
The getdate function is a Cisco Info Server SQL function that returns the current date and time. You can use this in a simple calculation to establish a time relative to now. The calculation is made in seconds, thus 300 represents three hundred seconds or five minutes. For example, to represent the time ten minutes ago, specify:
getdate - 600
The In and Not In comparison uses a list of values, rather than a single value. When you select In or Not In as an operator, a value list is displayed. To add a value to the list, specify the value, then click on the Add button or press the Return key.
To remove a value from the list, select the value in the list, then click on the Remove button.
Figure 3-6 shows the value list.
When you use a single condition element, you are limited to simple comparisons. Logical elements allow two elements to be combined for more complex comparisons. A logical element may have a boolean operator of either:
Two methods of inserting a logical element are available: the Leading Logical and the Trailing Logical buttons.
To create a logical element:
1. Select an existing element, for example a condition.
2. Click on either the Leading Logical or Trailing Logical button.
3. Select the boolean operator.
4. Click on the Condition button to add another condition branch.
Table 3-1 shows what happens when you select either a conditional or logical element and then click on one of the logical buttons.
| Element | Click on the Leading Logical Button | Click on the Trailing Logical Button |
Condition Element | Creates a logical element as the child of whatever was the parent of the condition element. The condition element becomes the child of the logical element. | Disabled: condition elements cannot have children. |
Logical Element | Creates a logical element as the child of whatever was the parent of the logical element. The condition element becomes the child of the logical element. | The logical element is added as a child of the insertion point logical element. When the insertion point already has two children, this button is disabled. |
No Element Selected | Creates a single logical element. | Creates a single logical element. |
The example is shown in Figure 3-7. Acknowledged is a integer value for which 0 = No, and 1 = Yes. Severity names map to integer numbers 0-6, thus the use of integers and not string values. The Filter Builder manages the translations between names and values.
When a logical element is selected, the element inspector displays two buttons: And and Or. Logical elements are created by default as And; for an Or logical element, you should select the element and then select Or in the element inspector. Figure 3-7 shows the Filter Builder for this example.
The negate element is always inserted before the current insertion point. The negate element inverts the result of what follows it in the tree.
Apart from the fact a negate element has only one child in the tree, it can generally be manipulated as a logical element.
For example, you could specify a conditional element that finds all of the alerts having a severity of warning, as shown in Figure 3-8.
Click on the element to select it, then when you click on the Negate button, the filter tree changes. Figure 3-9 shows the negate element.
To create a sub-query element:
1. Click on the Sub Query button.
2. Select the field to be used in the search, in the same way as a conditional element, from the Column options button.
3. Select either In to search for contents of the field, or Not in to search for the absence of the contents of the field, from the Operator button.
4. Select the field to be used when building the list, against which the In or Not In operation is to be performed, from the Select button. The options in this button are determined by the From button.
5. Select the table, from which to derive the information, using the From options button. This can be set to details, journal, or status.
An example is to use the sub query element to compare the Identifier fields of the status table and the details table. Figure 3-10 shows how the sub query element is displayed in the Filter Builder.
Unlike conditional elements, a sub query element can be followed by conditional, logical, and sub query elements. These elements allow you to specify selection criteria for the information from the other table. For example, you may wish to select only alerts which have a particular detail attribute.
Figure 3-11 shows how the sub query element is displayed in the Filter Builder.
This example element compares the Identifier fields of the status table and the details table, where the records in the details table also contain a Name field with the value SpecialValueAlert.
The elements that follow the sub query element also refer to the same table as the sub query.
Three methods exist for deleting an element from the filter:
The Edit menu's Paste option is only available when elements have been cut or copied with the Edit menu's Cut or Copy options. When selected, the Filter Builder attempts to paste the elements on the Clipboard into the filter, relative to the currently selected element.
You can apply changes to the filter, without saving it, by using the Apply button. When run from within an Event List, the Filter Builder is preloaded with a filter from the system. Click on the Apply button to send any changes made back to the system. Click on the Close button to discard the changes.
The Apply button is not displayed when the Filter Builder is run from the Conductor. When run from the Conductor, all filters must be saved using the File menu's Save or Save As options.
On the Filter Builder, the icon to the right of the text field is the Drag Point. To drag a filter from the Filter Builder and drop it into the Event List, you must start the drag over this icon. The filter is then be applied to the Event List.
To use drag and drop from the Filter Builder:
1. Move the mouse pointer over the drag point icon.
2. Click and hold the middle mouse button.
3. Drag the mouse over an Event List. When the cursor is over a valid drop area, it changes color to green and a small Filter Builder icon is displayed.
4. Release the mouse button to drop the filter.
When the filter is not valid or incomplete, a red cross is overlaid on this icon and you can not start a drag operation from the drag point.
You can also create condition elements using drag and drop on an entry from the Event List into the Filter Builder. When performing this operation, the condition element is created from the column and value of that column where the drag and drop operation was started.
For example, when you click on the middle mouse button over an alert which has a Critical value in the Event List's Severity column, and drop this into the Filter Builder, a condition element is created and set to Severity=Critical(5).
Repeat this process to create more condition elements joined to the existing tree with an And logical element. Logical elements are discussed in "Create Logical Elements".
You can use drag and drop to use a filter in another Motif application.
All filters can have a metric associated with them. A metric is a measurement, which can be applied with the filter, to provide a useful figure. Metrics can, for example, be displayed in the Monitor boxes in the Event List.
The Metric panel consists of two options buttons, one for the measurement to be used and one to select which field is to be used. The first option button allows you to select the type of measurement, as described in Table 3-2.
| Option | Type of Measurement |
Average | Provides the average value of the field selected for all records that match the filter. |
Count | Provides a count of all the records that match the filter. The selected field is irrelevant to this option. |
Sum | Provides the sum of the field selected for all records that match the filter. |
Minimum | Provides the lowest value of the field selected in the records that match the filter. |
Maximum | Provides the highest value of the field selected in the records that match the filter. |
The other options button allows you to select a field to which the measurement is applied. Only the integer and time fields in an alert are available for the metric calculation.
Figure 3-12 shows the Filter SQL Edit window.
When you click on the OK button, the Filter Builder attempts to parse the SQL text and build a filter tree. When SQL errors occur, a window is displayed and you must correct the errors before you can continue.
Posted: Thu Mar 25 09:34:51 PST 1999
Copyright 1989-1999©Cisco Systems Inc.
