Products | Versions |
---|---|
TIBCO LogLogic Enterprise Virtual Appliance | 6.2.0 and higher |
By default correlation bloks are case-sensitive.
For example, consider a data model, myTestModel, that obtains logs from various sources. The data model contains a property called payload. The payload property captures a string in which the capitalization varies. It may be test in some logs and TEST in others, or a mixture of uppercase and lowercase letters. A correlation blok can be defined that uses the payload parameter:
USE myTestModel WITHIN 5m EVENT GROUP [EG1] AT LEAST 1 EVENTS WHERE payload = 'test'
A correlation blok may also be used in defining a Trigger ((Management > Advanced Features > Rule Management). If the above correlation blok was used, only logs containing a payload of test would trigger an alert. Any logs with a payload of TEST or mixed case such as TesT would be ignored by the correlation blok.
This may be desired. However, if all forms of test should trigger an alert then the payload parameter should be made case-insensitive.