User guide

Setting Event Parsers Configuring Event Parsers
9-11
AlliedView NMS Administration Guide (Setting Up Fault Management)
Tokenizer
String
Allows you to break up the input field into a series of tokens that can then be used in the output Event
object. The tokenizer definition is a string with the tokens represented by $1, $2, etc. Only positive
integers are allowed following '$'.
Example:
Consider the case, where you expect an event message text string as:
Line Card 31 failed on Shelf 54: No Response - (Match String).
The Line Card Number (31) and the Shelf Number (54) may be required while defining other proper-
ties of event, so they will be tagged as tokens with a token number.
Line Card $1 failed on Shelf $2: No Response - (Tokenizer String).
After such tokenization, the token number is used in the output event definition. Specifying $text$1
for any field in the output event definition will be replaced with the value 31, while specifying $text$2
will be replaced with 54.
Note: To identify the Replaceable parameter of a specific field, the token number
should be preceded by the field, for example $text$1 indicates the first
tokenized string of the field Message.
The tokens of any field can be used in any other field, provided this Note is followed.
Output String
The output of the event parser is an Event object, which will be the modified instance of the incoming
event. The attributes of the Event object are defined by what are specified in the event parser, so it is
necessary to select correct values for important attributes such as failure object (affected Entity),
severity, and message text.
The properties that should remain unchanged must be specifically noted by placing a dollar followed
by that property name. For example, if the text field should not be modified, then the value $text
should be entered in the Output String.
When specifying the output values in the definition column, to use the values of the incoming event
properties, you should specify the exact property name (case sensitive) with a prepended $. For exam-
ple to use the event property source, the definition should be $source. If the particular property has
been tokenized and if user intends to use the value of the token, then the format should be $proper-
tyname$N, where N should be the count of the token starting with 1.
When it is necessary to deliberately have a null value for a specific property of the Output Event, then
the Output String for that property should be left blank.
The default properties of event that can be used in the definition column following $ are: category,
domain, entity, groupName, helpURL, network, node, source, severity, text, WebNMS. Apart from
the listed default properties of the event, user property names can also be used.
For the list of the various Event Properties and their description, refer to Event Properties.
TABLE 9-4 Event Parser Configuration Form (Continued)
Option Description