Synthetic parent for deployed pattern fields not being populated as expected
The fields of synthetic parent event within a group generated by a deployed patterns are not being populated as expected.
Problem
The fields of synthetic parent event within a group generated by a deployed patterns are not being populated as expected.
Cause
The pattern displays no groups or events for one of the following reasons.
- The pattern creation process is not finished. The pattern creation process can take a long time to complete due to large datasets and high numbers of suggested patterns.
- The pattern creation process was stopped before it completed.
Resolution
The synthetic parent event is created by the createSyntheticEvent function in
the PG_PROCESSPATTERNS Impact policy. Review the log file for this policy to
determine if there are any errors.
A number of standard fields are set when the synthetic event is created. These fields are set as
follows:
AlertGroupis set to whatever is specified in the Parent Event tab for the pattern.Identifieris set to the name of the pattern instance. The name of the pattern instance is made up of the configuration name, resource fields and a timestamp element.FirstOccurrenceandLastOccurrenceare set to the current date and time.Manageris always set to the text "Related Events";Nodeis set to the value of theNodefield of the live Netcool®/OMNIbus events which triggered pattern instance creation.NodeAliasis set to theNodeAliasof the live Netcool/OMNIbus events which triggered pattern instance creation.Severityis set to whatever is specified in the Parent Event tab for the pattern.Summaryis set to whatever is specified in the Parent Event tab for the pattern.
Event Analytics Defect 70854