This appendix defines the different variables you can use when creating an action policy.
Use the following menu options to navigate the SL1 user interface:
- To view a pop-out list of menu options, click the menu icon ().
- To view a page containing all of the menu options, click the Advanced menu icon ().
This appendix covers the following topics:
Run Book Variables
You can include variables when creating an action policy. These variables are listed in the table below.
- In an action policy of type Send an Email Notification, you can include one or more of these variables in the fields Email Subject and Email Body.
- In an action policy of type Send an SNMP Trap, you can include one or more of these variables in the Trap OID field, Varbind OID field, and the Varbind Value field.
- In an action policy of type Create a New Ticket, you can include one or more of these variables in the Description field or the Note field of the related Ticket Template.
- In an action policy of type Send an SNMP Set, you can include one or more of these variables in the SNMP OID field and the SNMP Value field.
- In an action policy of type Run A Snippet, you can access variables from the global dictionary EM7_VALUES.
- In a policy of type Execute an SQL Query, you can include one or more of these variables in the SQL Query field.
Variable |
Source |
Description |
---|---|---|
%A | Account | Username |
%N | Action | Automation action name |
%g | Asset | Asset serial |
%h | Asset | Device ID associated with the asset |
%i (lowercase "eye") | Asset | Asset Location |
%k | Asset | Asset Room |
%K | Asset |
Asset Floor |
%P | Asset | Asset plate |
%p | Asset | Asset panel |
%q | Asset | Asset zone |
%Q | Asset | Asset punch |
%U | Asset | Asset rack |
%u | Asset | Asset shelf |
%v | Asset | Asset tag |
%w | Asset | Asset model |
%W | Asset | Asset make |
%m | Automation | Automation policy note |
%n | Automation | Automation policy name |
%F | Dynamic Alert | Alert ID for a Dynamic Application Alert |
%I (uppercase "eye") | Dynamic Alert | For events with a source of "dynamic", this variable contains the index value from SNMP. For events with a source of "syslog" or "trap", this variable contains the value that matches the Identifier Pattern field in the event definition. |
%T | Dynamic Alert | Value returned by the Threshold function in a Dynamic Application Alert. |
%V | Dynamic Alert | Value returned by the Result function in a Dynamic Application Alert. |
%L | Dynamic Alert | Value returned by the label variable in a Dynamic Application Alert. |
%a | Entity | IP address |
%_category_id | Entity | Device category ID associated with the entity in the event. |
%_category_name | Entity | Device category name associated with the entity in the event. |
%_class_id | Entity | Device class ID associated with the entity in the event. |
%_class_name | Entity | Device class description associated with the entity in the event. |
%_parent_id |
Entity |
For component devices, the device ID of the parent device. |
%_parent_name |
Entity |
For component devices, the name of the parent device. |
%_root_id |
Entity |
For component devices, the device ID of the root device. |
%_root_name |
Entity |
For component devices, the name of the root device. |
%1 (one) | Event |
Entity type. Possible values are:
|
%2 | Event |
Sub-entity type. Possible values for organizations are:
Possible values for devices are:
|
%4 | Event | Text string of the user name that cleared the event. |
%5 | Event | Date/time when event was deleted. |
%6 | Event | Date/time when event became active. |
%7 | Event |
Event severity (1-5), for compatibility with previous versions of SL1. 1=critical, 2=major, 3=minor, 4=notify, 5=healthy. NOTE: When referring to an event, %7 represents severity (for previous versions of SL1). When referring to a ticket, %7 represents the subject line of an email used to create a ticket. |
%c | Event | Event counter |
%d | Event | Date/time when last event occurred. |
%D | Event | Date/time of first event occurrence. |
%e | Event | Event ID |
%H | Event | URL link to event |
%M | Event | Event message |
%s | Event | severity (0 - 4). 0=healthy, 1=notify, 2=minor, 3=major, 4=critical. |
%S | Event | Severity (HEALTHY - CRITICAL) |
%_user_note | Event | Current note about the event that is displayed on the Events page. |
%x | Event | Entity ID |
%X | Event | Entity name |
%y | Event | Sub-entity ID |
%Y | Event | Sub-entity name |
%Z | Event | Event source (Syslog - Group) |
%z | Event | Event source (1 - 8) |
%_ext_ticket_ref | Event | For events associated with an external Ticket ID, this variable contains the external Ticket ID. |
%3 | Event Policy | Event policy ID |
%E | Event Policy | External ID from event policy |
%f | Event Policy | Specifies whether event is stateful, that is, has an associated event that will clear the current event. 1 (one)=stateful; 0 (zero)=not stateful. |
%G | Event Policy | External Category |
%R | Event Policy | Event policy cause/action text |
%_event_policy_name | Event Policy | Name of the event policy that triggered the event. |
%B | Organization | Organization billing ID |
%b | Organization | Impacted organization |
%C | Organization | Organization CRM ID |
%o (lowercase "oh") | Organization | Organization ID |
%O (uppercase "oh") | Organization | Organization name |
%r | System | Unique ID / name for the current SL1 system |
%7 | Ticket |
Subject of email used to create a ticket. If you specify this variable in a ticket template, SL1 will use the subject line of the email in the ticket description or note text when SL1 creates the ticket. NOTE: When referring to a ticket, %7 represents the subject line of an Email used to create a ticket. When referring to an event, %7 represents severity (for previous versions of SL1). |
%t | Ticket | Ticket ID |
%J | Ticket | Description field from the SL1 ticket. |