Hello. I am receiving events from an integration where the configuration item information is part of the description of the received event as shown in the examples below:
XXX12345: Processor load (1 min average) TRIGGERED EVENT: Processor load is too high
XXXX123456: CPU idle time TRIGGERED EVENT: CPU utilization is more than 97% in the last 3 hours
XXX12345678_:Get status TRIGGERED EVENT: Apache: Failed to fetch status page (or no data for 30m)
XXX12345, XXXX123456 AND XXX12345678 are examples of CI names.
M y ics have various naming formats that can vary between 8 and 24 characters. the rule I know is that after the end of the ic name I receive the characters : or _:
How can I create a rule in the event rule to try to identify my IC considering the characters in the description field of the event before the first appearance of the characters : or _:
Thank you for the help.
Best Regards.
