Normalized Event Search Limitations

Searching for and Viewing Events › Event Search Syntax Guidelines and Best Practices › Normalized Event Search Limitations

Normalized Event Search Limitations

The following table shows the operators and functions that you can use for normalized event searches and which of them will work in a deployed policy.

	Search	Deployed Policy
Operators	All	All except >, <, >=, <=
'not' function	Yes	No
'fn:Parse' function	Yes	Yes
nested or embedded functions	Yes	No
'contains', 'ends-with', and 'starts-with' functions	Yes	No

Note:

The ‘not’ function does not support two operands. For example, not(mdr_dept='Finance' and mdr_size='11') is not supported. However, not (matches(Severity,'Major')) and not (matches(Assignee,'Smith')) is supported.
A limit of ten fn:Parse statements can appear in a deployed event policy.

Copyright © 2013 CA. All rights reserved.