Adding columns to seasonal and related event reports

You can add columns to seasonal event reports and related events reports by updating the aggregated field configuration.

1. Generate a properties file containing the latest Event Analytics system settings.
   1. Navigate to the directory $IMPACT_HOME/bin.
   2. Run the following command to generate a properties file containing the latest Event Analytics system settings.

      nci_trigger server_name username/password NOI_DefaultValues_Export
       FILENAME directory/filename

      Where:

      • server_name is the name of the server where Event Analytics is installed.
      • user name is the user name of the Event Analytics user.
      • password is the password of the Event Analytics user.
      • NOI_DefaultValues_Export is a Netcool/Impact policy that performs an export of the current Event Analytics system settings to a designated properties file.
      • directory is the directory where the properties file is stored.
      • filename is the name of the properties file.

      For example:

      nci_trigger NCI impactadmin/impactpass NOI_DefaultValues_Export
       FILENAME /tmp/properties.props

2. Update the properties file that you generated.
   1. Specify the number of columns you want to add to the reports:
      • Increase the value of the number_of_rollup_configuration=2 parameter for seasonal events.
      • Increase the value of the reevent_number_of_rollup_configuration=2 parameter for related events.
      For example, to add one column to the reports, increase the parameter value by one from 2 to 3.
   2. For a new rollup column, add property information.
      • For a new Seasonal Event reports column, add the following properties.

        rollup_<rollup number>_column_name=<column name>
        rollup_<rollup number>_display_name=<column_name>_<type>
        rollup_<rollup number>_type=<type>

      • For a new Related Events reports column, add the following properties.

        reevent_rollup_<rollup number>_column_name=<column name>
        reevent_rollup_<rollup number>_display_name=<column_name>_<type>
        reevent_rollup_<rollup number>_type=<type>
        reevent_rollup_<rollup number>_actionable=<true/false>
        

      <rollup number>

      Specifies the new column rollup number.

      <column name>

      Specifies the new column name. The column name must match the column name in the history table.

      <display name>

      Specifies the new column display name. The display name must match the column name in the report.

      <type>

      Specifies one of the following types:

      MAX

      The maximum value observed for the column. If no value is observed, the value defaults to the minimum value of an integer.

      MIN

      The minimum value observed for the column. If no value is observed, the value defaults to the maximum value of an integer.

      SUM

      The sum of all of the values observed for the column.

      NON_ZERO

      A counting column that counts nonzero occurrences of events. This column can be useful to track the proportion of actioned events, or how many events had an associated ticket number.

      DISTINCT

      The number of distinct values that are seen for this key-value pair.

      EXAMPLE

      Displays the first non-blank example of a field that contained this key. The EXAMPLE type is useful when you are running seasonality on a field that can't be accessed, such as ALERT_IDENTIFIER, and you want an example human readable SUMMARY to demonstrate the type of problem.

      Note: You cannot change the <type> property of a rollup column once the configuration has been updated. You must add a new rollup column and specify a different <type> (with a new <display name> if you are keeping the old rollup).

      actionable=<true/false>

      If this property is set to true for a rollup, the rollup is used to determine the probable root cause of a correlation rule. This root cause determination is based on the rollup that has the most actions that are taken against it. For example, if Acknowledge is part of your rollup configuration and has a property value of actionable=true, then the event with the highest occurrence of Acknowledge is determined to be the probable root cause. Probable root cause determination uses the descending order of the actionable rollups, that is, the first actionable rollup is a higher priority than the second actionable rollup. Only four of the possible <type> keywords are valid for root cause: MAX, MIN, SUM, NON_ZERO.

      If this property is set to false for a rollup, the rollup is not used to determine the probable root cause of a rule. If all rollup configurations have a property value of actionable=false, the first event that is found is identified as the parent.

      To manually change a root cause event for a correlation rule, see Selecting a parent event for a correlation rule.

3. Import the modified properties file into Event Analytics.
   1. Ensure you are in the directory $IMPACT_HOME/bin.
   2. Run the following command to perform an import of Event Analytics system settings from a designated properties file.

      nci_trigger server_name username/password NOI_DefaultValues_Configure
       FILENAME directory/filename

      Where:

      • server_name is the name of the server where Event Analytics is installed.
      • user name is the user name of the Event Analytics user.
      • password is the password of the Event Analytics user.
      • NOI_DefaultValues_Configure is a Netcool/Impact policy that performs an import of Event Analytics system settings from a designated properties file.
      • directory is the directory where the properties file is stored.
      • filename is the name of the properties file.

      For example:

      nci_trigger NCI impactadmin/impactpass NOI_DefaultValues_Configure
       FILENAME /tmp/properties.props

number_of_rollup_configuration=3
rollup_1_column_name=SEVERITY
rollup_1_display_name=SEVERITY_MIN
rollup_1_type=MIN
rollup_2_column_name=SEVERITY
rollup_2_display_name=SEVERITY_MAX
rollup_2_type=MAX
rollup_3_column_name=TYPE
rollup_3_display_name=TYPE_MAX
rollup_3_type=MAX

reevent_rollup_1_column_name=ORIGINALSEVERITY
reevent_rollup_1_display_name=ORIGINALSEVERITY_MAX
reevent_rollup_1_type=MAX
reevent_rollup_1_actionable=true
reevent_rollup_2_column_name=ACKNOWLEDGED
reevent_rollup_2_display_name=ACKNOWLEDGED_NON_ZERO
reevent_rollup_2_type=NON_ZERO
reevent_rollup_2_actionable=true
reevent_rollup_3_column_name=ALERTGROUP
reevent_rollup_3_display_name=ALERTGROUP_EXAMPLE
reevent_rollup_3_type=EXAMPLE
reevent_rollup_3_actionable=false

SERVERSERIAL.hidden=true
SERVERNAME.hidden=true
TALLY.hidden=true
OWNERUID.hidden=true

OWNERUID.hidden=false

#OWNERUID.hidden=true