Incomming events are missing value in Severity field - how do I set the value - via Event Rules??

[JanneHjorth]

Hi all.

I'm new to Event Management and at the moment we experience incomming events, where Severity field is empty. So no alerts are created. I have this record:

How can I set a value in Severity field and secure the creation of alerts??

I really need a helping hand here - thanks in advance.

Regards, 

Janne

[patrickkenney · Accepted solution]

The Manual attributes will create a new Additional Details JSON pair. You will want to place a number, 0-5, into the Severity field. When the Transform contains a variable representation like ${severity}, it will use the value sent from the default event. In your case that is currently empty.

[JanneHjorth]

Ahhh - ok - so I need to put in the value 4 into the Severity field like this:

[patrickkenney]

Correct. If you have different events that need different severities then you will need a unique rule with all the criteria needed to identify the event severity needed. Unfortunately Event rules do not have an if then else flow to them.

If you can determine the severity at the source and pass that with the event, you can eliminate the need for the rules.