cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
393
Views
0
Helpful
2
Replies

CS-MARS: linking custom events to existing event-groups

mogli
Level 1
Level 1

Hi,

i've created a custom event in the course of working with custom parsers (which works fine in most cases).

i would like to add this custom event to an existing event-group. this would be important because every time the custom event occurs the existing rules (were the event-group is used) would be fired and an incident would be created.

if the custom event won't be added to existing event-groups, i'll never get an incident because no rule will match (no existing

rule uses my new event).

is there a possibility to add my custom event to an existing group??

many thanks i've you have an idea to solve my request.

kind regards,

bernhard

1 Accepted Solution

Accepted Solutions

mhellman
Level 7
Level 7

Sorry, you cannot modify the event groups. That is why it is so important when creating parsers to use existing events whenever possible. If there is an existing event that even comes close to meaning the same thing, you might be better off using it. Otherwise, you must create a custom inspection rule to deal with the custom event.

View solution in original post

2 Replies 2

mhellman
Level 7
Level 7

Sorry, you cannot modify the event groups. That is why it is so important when creating parsers to use existing events whenever possible. If there is an existing event that even comes close to meaning the same thing, you might be better off using it. Otherwise, you must create a custom inspection rule to deal with the custom event.

thanks a lot for your answer!! maybe that's something for a feature-request?!?!? :-))

the reason i would like to have this feature is because i like to set in some cases other severities to the events than the predefined one's.

sure, i could use any other predefined event (which points to a nearly similar topic) with the recommended severity. but i would get an event with a description which doesn't match to that what really happened...

in my opinion an very unattractive workaround (in this case there is at least a work around ;-)..

best regards,

bernhard