Run Book Variables

This appendix defines the different variables you can use when creating an action policy.

Use the following menu options to navigate the SL1 user interface:

To view a pop-out list of menu options, click the menu icon ().
To view a page containing all of the menu options, click the Advanced menu icon ().

This appendix covers the following topics:

Run Book Variables

You can include variables when creating an action policy. These variables are listed in the table below.

In an action policy of type Send an Email Notification, you can include one or more of these variables in the fields Email Subject and Email Body.
In an action policy of type Send an SNMP Trap, you can include one or more of these variables in the Trap OID field, Varbind OID field, and the Varbind Value field.
In an action policy of type Create a New Ticket, you can include one or more of these variables in the Description field or the Note field of the related Ticket Template.
In an action policy of type Send an SNMP Set, you can include one or more of these variables in the SNMP OID field and the SNMP Value field.
In an action policy of type Run A Snippet, you can access variables from the global dictionary EM7_VALUES.
In a policy of type Execute an SQL Query, you can include one or more of these variables in the SQL Query field.

Variable	Source	Description
%A	Account	Username
%a	Entity	IP address
%F	Dynamic Alert	Alert ID for a Dynamic Application Alert
%g	Asset	Asset serial
%h	Asset	Device ID associated with the asset
%I (uppercase "eye")	Dynamic Alert	For events with a source of "dynamic", this variable contains the index value from SNMP. For events with a source of "syslog" or "trap", this variable contains the value that matches the Identifier Pattern field in the event definition.
%i (lowercase "eye")	Asset	Asset Location
%K	Asset	Asset Floor
%k	Asset	Asset Room
%L	Dynamic Alert	Value returned by the label variable in a Dynamic Application Alert.
%m	Automation	Automation policy note
%N	Action	Automation action name
%n	Automation	Automation policy name
%P	Asset	Asset plate
%p	Asset	Asset panel
%Q	Asset	Asset punch
%q	Asset	Asset zone
%T	Dynamic Alert	Value returned by the Threshold function in a Dynamic Application Alert.
%U	Asset	Asset rack
%u	Asset	Asset shelf
%v	Asset	Asset tag
%W	Asset	Asset make
%w	Asset	Asset model
%V	Dynamic Alert	Value returned by the Result function in a Dynamic Application Alert.
%_category_id	Entity	Device category ID associated with the entity in the event.
%_category_name	Entity	Device category name associated with the entity in the event.
%_class_id	Entity	Device class ID associated with the entity in the event.
%_class_name	Entity	Device class description associated with the entity in the event.
%_parent_id	Entity	For component devices, the device ID of the parent device.
%_parent_name	Entity	For component devices, the name of the parent device.
%_root_id	Entity	For component devices, the device ID of the root device.
%_root_name	Entity	For component devices, the name of the root device.
%_service_investigator_url	Entity	The URL of the Business Service Investigator page for the event that triggered the automation (for run book actions that run against events aligned with business services).
%1 (one)	Event	Entity type. Possible values are: 0. Organization 1. Device 2. Asset 4. IP Network 5. Interface 6. Vendor 7. Account 8. Virtual Interface 9. Device Group 10. IT Service 11. Ticket
%2	Event	Sub-entity type. Possible values for organizations are: 9. News feed Possible values for devices are: 1. CPU 2. Disk 3. File System 4. Memory 5. Swap 6. Component 7. Interface 9. Process 10. Port 11. Service 12. Content 13. Email
%4	Event	Text string of the user name that cleared the event.
%5	Event	Date/time when event was deleted.
%6	Event	Date/time when event became active.
%7	Event	Event severity (1-5), for compatibility with previous versions of SL1. 1=critical, 2=major, 3=minor, 4=notify, 5=healthy. NOTE: When referring to an event, %7 represents severity (for previous versions of SL1). When referring to a ticket, %7 represents the subject line of an email used to create a ticket.
%c	Event	Event counter
%d	Event	Date/time when last event occurred.
%D	Event	Date/time of first event occurrence.
%e	Event	Event ID
%H	Event	URL link to event
%M	Event	Event message
%s	Event	severity (0 - 4). 0=healthy, 1=notify, 2=minor, 3=major, 4=critical.
%S	Event	Severity (HEALTHY - CRITICAL)
%_user_note	Event	Current note about the event that is displayed on the Events page.
%x	Event	Entity ID
%X	Event	Entity name
%y	Event	Sub-entity ID
%Y	Event	Sub-entity name
%Z	Event	Event source (Syslog - Group)
%z	Event	Event source (1 - 8)
%_ext_ticket_ref	Event	For events associated with an external Ticket ID, this variable contains the external Ticket ID.
%3	Event Policy	Event policy ID
%E	Event Policy	External ID from event policy
%f	Event Policy	Specifies whether event is stateful, that is, has an associated event that will clear the current event. 1 (one)=stateful; 0 (zero)=not stateful.
%G	Event Policy	External Category
%R	Event Policy	Event policy cause/action text
%_event_policy_name	Event Policy	Name of the event policy that triggered the event.
%B	Organization	Organization billing ID
%b	Organization	Impacted organization
%C	Organization	Organization CRM ID
%o (lowercase "oh")	Organization	Organization ID
%O (uppercase "oh")	Organization	Organization name
%r	System	Unique ID / name for the current SL1 system
%7	Ticket	Subject of email used to create a ticket. If you specify this variable in a ticket template, SL1 will use the subject line of the email in the ticket description or note text when SL1 creates the ticket. NOTE: When referring to a ticket, %7 represents the subject line of an Email used to create a ticket. When referring to an event, %7 represents severity (for previous versions of SL1).
%t	Ticket	Ticket ID
%J	Ticket	Description field from the SL1 ticket.