Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk AppDynamics
- :
- Re: Health Rule - Affected Entities
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When setting Affected Entities for Health Rules there is an option to state:
"Business Transactions matching the following criteria"
I have used this to exclude certain business transactions and set it to "Business Transactions matching the following criteria" NOT contains "_CatchAll"
I would like to exclude business transactions that have _CatchAll or GetCSS.aspx in the BT name - is this possible?
Can I simply set it to "Business Transactions matching the following criteria" NOT contains "_CatchAll,GetCSS.aspx"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
As the health rule does not have the option to use the "in list" condition, you will have to revert to regex
Just a simple test would look like this, that would match any BT name that does not have the following 2 words in the name
^(?!.*(_CatchAll|GetCSS.aspx)).*$
Not exactly sure how AppD would want the syntax and if it will work as above, however this piece works in normal regex
Ciao
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
As the health rule does not have the option to use the "in list" condition, you will have to revert to regex
Just a simple test would look like this, that would match any BT name that does not have the following 2 words in the name
^(?!.*(_CatchAll|GetCSS.aspx)).*$
Not exactly sure how AppD would want the syntax and if it will work as above, however this piece works in normal regex
Ciao
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks - this is helpful
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
