Manipulate CI Name

[paimon.soror]

Hi Folks;

 

I researched this a bit from the SOI side and it didn't really seem like there was a way to do this, so I was wondering if it was possible from Spectrum.

 

We set up a custom metric in APM that will help us identify an issue with metric gathering.  The issue here is that the metric as it gets reported into Spectrum has a long CI Name that we would like to shorten and ideally make it 'reflect' that it came from our agent server.

 

For example:

 

Alert:

Name -> Custom Metric Host (Virtual)_Custom Metric Process (Virtual)_Custom Metric Agent (Virtual)

Summary -> Application|Database Metric

 

I would, if possible, like to have the source be 'enriched' to show the following

 

Alert:

Name -> abc1234

Summary -> Application|Database Metric

 

I know its a stretch, but I was hoping someone had run into something like this in the past.  Thanks!

[Anon Anon]

Hello Paimon,

 

I understand that this metric is reflected as an event variable in the event. I think we can do this with an event procedure by splitting this event variable into 2 and then populating the required event variable containing one half of the event variable in the new event.

 

Ex:

 

0xffff0000 E 50 P " \ Original Event to pull the info from

  CreateEventWithAttributes( \

    { C CURRENT_MODEL }, \

    { H 0xffff0001 }, \ New event to be created

SetEventAttribute( \

SetEventAttribute( \

GetEventAttributeList(), \

{ U 2 }, \ Variable to that needs to be split New variable containing the first half of the extracted data

GetRegexp( \

GetEventAttribute( { U 1 } ), \ Variable of the original event that needs to be split

{ S \"(.*)/(.*)\" }, \ Regex expression to search for (you may need to escape the “/”, I’m not sure)

{ U 1 } )), \ Regexp piece to extract (if you use several “(…)” in your regexp, indicates which one you care about): in your example this would extract “one”

      { U 3 }, \ ??New variable containing the other half of the extracted data

GetRegexp( \

GetEventAttribute( { U 1 } ), \ Variable of the original event that needs to be split

{ S \"(.*)/(.*)\" }, \ Regex expression to search for

{ U 2 } )))"

 

Other way is if we have an attribute populating the metric name, we can push this attribute value to this event variable  in the new event.