|
|
| Subject: | Dropping specific events |
| Author: | [Not Specified] |
| Posted: | 2014-06-03 07:11 |
I have a transform setup, but I'm betting I have a syntax error since the events that should be matching this are not being dropped. Here's my transform:
if "BlackBerry MDS Connection Service" in getattr(evt, 'component', ''):
evt._action = "drop"
So I'm trying to look at the Component value, then drop it.
| Subject: | maybe this works: |
| Author: | [Not Specified] |
| Posted: | 2014-06-03 09:25 |
maybe this works:
if evt.component.find("BlackBerry MDS Connection Service") >=0:
evt._action = "drop"
| Subject: | That would not be a syntax |
| Author: | [Not Specified] |
| Posted: | 2014-06-03 09:59 |
That would not be a syntax error, it's just not matching an event. Please give us additional details: what event class did you put that transform at What is the component field of the events Is it from a SNMP trap
Hydruid
| Subject: | The class as it sits right |
| Author: | [Not Specified] |
| Posted: | 2014-06-03 11:10 |
The class as it sits right now is /Unknown, and the component value is 'Blackberry MDS Connection Service'.
| Subject: | So the event lands in the |
| Author: | [Not Specified] |
| Posted: | 2014-06-03 11:42 |
So the event lands in the /Unknown Event Class and you put the transform on /Unknown as well Does the text of the transform turn red after you click save Try copying the text directly from the event's component to verify there isn't an extra space or something missed.
Hydruid
| < |
Previous [Solved] Graph Data Order |
Next [SOLVED] WINRM Support |
> |