Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk AppDynamics
- :
- Re: Health Rule - Affected Entities
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When setting Affected Entities for Health Rules there is an option to state:
"Business Transactions matching the following criteria"
I have used this to exclude certain business transactions and set it to "Business Transactions matching the following criteria" NOT contains "_CatchAll"
I would like to exclude business transactions that have _CatchAll or GetCSS.aspx in the BT name - is this possible?
Can I simply set it to "Business Transactions matching the following criteria" NOT contains "_CatchAll,GetCSS.aspx"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
As the health rule does not have the option to use the "in list" condition, you will have to revert to regex
Just a simple test would look like this, that would match any BT name that does not have the following 2 words in the name
^(?!.*(_CatchAll|GetCSS.aspx)).*$
Not exactly sure how AppD would want the syntax and if it will work as above, however this piece works in normal regex
Ciao
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
As the health rule does not have the option to use the "in list" condition, you will have to revert to regex
Just a simple test would look like this, that would match any BT name that does not have the following 2 words in the name
^(?!.*(_CatchAll|GetCSS.aspx)).*$
Not exactly sure how AppD would want the syntax and if it will work as above, however this piece works in normal regex
Ciao
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks - this is helpful
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
