Unable to bind CI to events
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-22-2022 09:53 AM
Hello all,
I am working on an custome event rule where I am using Binding with the following conditions,
Binding Type: CI Field matching
CI Type: HTTP(S) Endpoint
Where name is sent as a part of additional information and it also contains short_description field. The issue here is if we don't send short_description from the source then the mapping works. But if we include it under Additional informational field then it gives an error "Binding Failure Reason: No matching CI found, while searching CI by type: cmdb_ci_endpoint_http with query: "short_description=test message Alert^name= google.com^type=2^install_status!=7^ORinstall_status=NULL""
I have added the CI under HTTP(S) Class table. Still it is using the short_description as a part of node search to bind the CI. Could someone please guide me on how to remove that short_description field from the bind criteria.
Regards,
Naresh
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
12-23-2022 06:11 AM
How to prevent the event rule from using short_description as a part of CI mapping.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-17-2024 11:01 AM
Did you ever get an answer to this? I want to say that information would be coming from the event source, but I'm not 100% sure.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-09-2023 07:30 PM
Hi Naresh, i have a similar query where i want to get rid of correlation-id from additional info which is getting passed via Splunk alert.
Were you able to find some solution for the above issue?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-29-2023 04:58 PM
Hi NCS1, Sorry I could not find a solution and it is still there. Have you got a solution for this?