Working Rules for Entering Values in Different Fields:
You can use 3 special characters while entering values in the fields, each with different purposes.
Wildcard characters:
1. * - To replace with one or more characters.
For example,
alarm* - Values start with the word alarm. 'alarmsone', 'alarmviewer' and so on.
*one* - Values contain the word one. 'alarmsone', 'oneauth' and so on.
*server - Values end with the word server. 'webserver', 'mailserver' and so on.
alarm* *server or *server alarm* - Field should contain a word that starts with alarm and another that ends with server anywhere in the phrase, in any order. 'alarmsone webserver is up', 'appserver alert in alarmsone', 'webserver alarmcentre', and so on.
2. ? - To replace with exactly one character.
For example,
nfa-pre-w? matches 'nfa-pre-w7', 'nfa-pre-w8' and so on.
Note: This doesn't match 'nfa-pre-w' or 'nfa-pre-w10 as there is no character replaced in nfa-pre-w , and two characters replaced in nfa-pre-w10.
Phrase matching:
3. " " - Matches the exact phrase.
For example,
"apache tomcat" - values contain the exact phrase apache tomcat. 'apache tomcat', 'server apache tomcat is down', 'apache tomcat server is down' and so on.
Note: This doesn't match 'tomcat apache' or 'apache licensed tomcat' as there isn't an exact phrase 'apache tomcat' in the two examples.
Words without special characters:
If you enter two or more words without the special characters ( " ", *, or ?), then the value matches the exact words, in any order.
For example,
apache tomcat - matches 'apache tomcat', 'apache tomcat is down', 'tomcat apache', 'apache licensed tomcat' , 'tomcat is apache' and so on.
If field value itself contains special characters (*, ?, or ") :
If your field value itself contains any of the above 3 special characters, prefix that character with a backslash ( \* , \? , \" ).
For example,
If message contains event*printer, enter the value as event\*printer.