-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathvmware-nsx-t-v4.0.7.vlcp
More file actions
1672 lines (1641 loc) · 294 KB
/
vmware-nsx-t-v4.0.7.vlcp
File metadata and controls
1672 lines (1641 loc) · 294 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{
"name":"VMware - NSX-T",
"namespace":"com.vmware.nsxt",
"contentPackId":"com.vmware.nsxt",
"framework":"#9c4",
"version":"3.2",
"extractedFields":[ {
"displayName":"vmw_nsxt_alarm_state",
"preContext":"alarmState=\"",
"postContext":"\"",
"regexValue":"\\S+?",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df",
"constraints":"{\"searchTerms\":\"comp subcomp NSX\"}",
"info":null
}, {
"displayName":"vmw_nsxt_audit_operation_status",
"preContext":"status(?::'|=\")",
"postContext":"(?:'|\")",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000",
"constraints":"{\"searchTerms\":\"comp subcomp\"}",
"info":null
}, {
"displayName":"vmw_nsxt_comp",
"preContext":"comp=\"",
"postContext":"\"",
"regexValue":"\\S+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000",
"constraints":"{\"searchTerms\":\"subcomp\"}",
"info":null
}, {
"displayName":"vmw_nsxt_display_name",
"preContext":"\"display_name\":\"",
"postContext":"\"",
"regexValue":"[\\w \\\\']+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3enfzxa3dbpfpw4ylnmu000000",
"constraints":"{\"searchTerms\":\"comp subcomp\"}",
"info":null
}, {
"displayName":"vmw_nsxt_edge_firewall_ruleid",
"preContext":"(?:REJECT|DROP|PASS) ",
"postContext":" (?:IN|OUT)",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fmrtwkx3gnfzgk53bnrwf64tvnrswsza0",
"constraints":"{\"searchTerms\":\"INET* FIREWALL\"}",
"info":null
}, {
"displayName":"vmw_nsxt_entid",
"preContext":"entId=\"",
"postContext":"\"",
"regexValue":"\\S+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0",
"constraints":"{\"searchTerms\":\"NSX comp subcomp\"}",
"info":null
}, {
"displayName":"vmw_nsxt_error_code",
"preContext":"errorCode=\"",
"postContext":"\"",
"regexValue":"\\S+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0",
"constraints":"{\"searchTerms\":\"comp subcomp\"}",
"info":null
}, {
"displayName":"vmw_nsxt_event_state",
"preContext":"\"event_state\":\\s?",
"postContext":"(?:,|})",
"regexValue":"\\S+?",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df",
"constraints":"{\"searchTerms\":\"comp subcomp NSX\"}",
"info":null
}, {
"displayName":"vmw_nsxt_event_type",
"preContext":"eventType=\"",
"postContext":"\"",
"regexValue":"\\S+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0",
"constraints":"{\"searchTerms\":\"comp subcomp NSX\"}",
"info":null
}, {
"displayName":"vmw_nsxt_eventid",
"preContext":"eventId=\"",
"postContext":"\"",
"regexValue":"\\S+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000",
"constraints":"{\"searchTerms\":\"comp subcomp NSX\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_reason",
"preContext":"(?:INET|INET6) ",
"postContext":" (?:PASS|DROP|REJECT|GOTO_FILTER)",
"regexValue":".*",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf64tfmfzw63q0",
"constraints":"{\"searchTerms\":\"INET*\",\"filters\":[{\"internalName\":\"appname\",\"displayName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"firewall_pktlog\",\"fieldType\":\"STRING\",\"isExtracted\":false,\"hidden\":false}]}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_action",
"preContext":"(?:match|TERM|L7 Rule pending) ",
"postContext":" (?:\\d+)",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf6yldoruw63q0",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_client_to_server_bytes",
"preContext":" ",
"postContext":"/\\d+.*$",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf6y3mnfsw45c7orxv643foj3gk4s7mj4xizlt",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_dst",
"preContext":"[A-Fa-f\\d]+->",
"postContext":"(?: |/|$)",
"regexValue":"[A-Fa-f\\d\\.:]+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf6zdtoq000000",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_dst_ip_port",
"preContext":"[A-Fa-f\\d]+->",
"postContext":"(?: |$)",
"regexValue":"[A-Fa-f\\d\\.:]+/\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf6zdtorpws4c7obxxe5a0",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_dst_port",
"preContext":"[A-Fa-f\\d]+->[A-Fa-f\\d\\.:]+/",
"postContext":"(?: |$)",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf6zdtorpxa33soq000000",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_protocol",
"preContext":"(?:IN|OUT) (\\d+ )?",
"postContext":"\\s",
"regexValue":"(?:TCP6?|UDP6?|ICMP|PROTO6? \\d+)",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf64dsn52g6y3pnq000000",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_ruleid",
"preContext":"(?:REJECT|DROP|PASS|GOTO_FILTER) ",
"postContext":" (?:IN|OUT)",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf64tvnrswsza0",
"constraints":"{\"searchTerms\":\"INET*\",\"filters\":[{\"hidden\":false,\"internalName\":\"appname\",\"displayName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"firewall-pktlog\",\"fieldType\":\"STRING\",\"isExtracted\":false}]}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_server_to_client_bytes",
"preContext":" \\d+/",
"postContext":".*$",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf643foj3gk4s7orxv6y3mnfsw45c7mj4xizlt",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_src",
"preContext":"\\S+\\s+",
"postContext":"(?:/|->)",
"regexValue":"[A-Fa-f\\d\\.:]+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf643smm000000",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_src_ip_port",
"preContext":"(?:TCP6?|UDP6?|ICMP|PROTO6? \\d+) ",
"postContext":"(->)",
"regexValue":"[A-Fa-f\\d\\.:]+/\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf643smnpws4c7obxxe5a0",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_firewall_src_port",
"preContext":"(?:TCP6?|UDP6?|ICMP|PROTO6? \\d+) [A-Fa-f\\d\\.:]+/",
"postContext":"(->)",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3gnfzgk53bnrwf643smnpxa33soq000000",
"constraints":"{\"searchTerms\":\"INET*\"}",
"info":null
}, {
"displayName":"vmw_nsxt_operation",
"preContext":"Operation(?::'|=\")",
"postContext":"(?:'|\")",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000",
"constraints":"{\"searchTerms\":\"comp subcomp\"}",
"info":null
}, {
"displayName":"vmw_nsxt_s2comp",
"preContext":"s2comp=\"",
"postContext":"\"",
"regexValue":"\\S+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tgjrw63lq",
"constraints":"{\"searchTerms\":\"comp subcomp\"}",
"info":null
}, {
"displayName":"vmw_nsxt_subcomp",
"preContext":"subcomp=\"",
"postContext":"\"",
"regexValue":"\\S+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000",
"constraints":"{\"searchTerms\":\"comp\"}",
"info":null
}, {
"displayName":"vmw_nsxt_user",
"preContext":"UserName(?::'|=\")",
"postContext":"(?:'|\")",
"regexValue":".+?",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000",
"constraints":"{\"searchTerms\":\"comp subcomp\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_event_type",
"preContext":"event_type\":\\s+\"",
"postContext":"\",\\s+\"event_trigger",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3fozsw45c7or4xazi0",
"constraints":"{\"searchTerms\":\"\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_origin_fw_type",
"preContext":"fw_type\":\\s+\"",
"postContext":"\",\\s+\"fw_uuid",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3pojuwo2lol5thox3upfygk000",
"constraints":"{\"searchTerms\":\"origin\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_origin_fw_uuid",
"preContext":"fw_uuid\":\\s+\"",
"postContext":"\",\\s+\"node_uuid",
"regexValue":"[A-Fa-f\\d\\-]+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3pojuwo2lol5thox3vovuwi000",
"constraints":"{\"searchTerms\":\"origin\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_flow_start",
"preContext":"start\":\\s+\"",
"postContext":"\",\\s+\"end",
"regexValue":"[-\\d\\:\\.TZ]+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3gnrxxox3torqxe5a0",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_flow_end",
"preContext":"end\":\\s+\"",
"postContext":"\",\\s+\"ip_ver",
"regexValue":"[-\\d\\:\\.TZ]+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3gnrxxox3fnzsa0000",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_flow_ip_ver",
"preContext":"ip_ver\":\\s+\"",
"postContext":"\",\\s+\"flow_id",
"regexValue":"ipv\\d",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3gnrxxox3jobpxmzls",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_flow_src_ip",
"preContext":"src_ip\":\\s+\"",
"postContext":"\",\\s+\"src_port",
"regexValue":"[A-Fa-f\\d\\.:]+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3gnrxxox3tojrv62lq",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_flow_src_port",
"preContext":"src_port\":\\s+",
"postContext":",\\s+\"dest_ip",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3gnrxxox3tojrv64dpoj2a0000",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_flow_dest_ip",
"preContext":"dest_ip\":\\s+\"",
"postContext":"\",\\s+\"dest_port",
"regexValue":"[A-Fa-f\\d\\.:]+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3gnrxxox3emvzxix3joa000000",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_flow_dest_port",
"preContext":"dest_port\":\\s+",
"postContext":",\\s+\"proto",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3gnrxxox3emvzxix3qn5zhi000",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_flow_proto",
"preContext":"proto\":\\s+\"",
"postContext":"\",\\s+\"tcp_flags",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3gnrxxox3qojxxi3y0",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_bytes_toserver",
"preContext":"bytes_toserver\":\\s+",
"postContext":",\\s+\"bytes_toclient",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3cpf2gk427orxxgzlsozsxe000",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_bytes_toclient",
"preContext":"bytes_toclient\":\\s+",
"postContext":",\\s+\"",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3cpf2gk427orxwg3djmvxhi000",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_flow_final_action",
"preContext":"final_action\":\\s+\"",
"postContext":"\"\\s?}",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3gnrxxox3gnfxgc3c7mfrxi2lpny000000",
"constraints":"{\"searchTerms\":\"flow\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_fw_action",
"preContext":"action\":\\s+\"",
"postContext":"\",\\s+\"rule_id",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3go5pwcy3unfxw4000",
"constraints":"{\"searchTerms\":\"fw\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_fw_rule_id",
"preContext":"rule_id\":\\s+",
"postContext":",\\s+\"direction",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3go5pxe5lmmvpwsza0",
"constraints":"{\"searchTerms\":\"fw\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_fw_rule_tag",
"preContext":"rule_tag\":\\s+\"",
"postContext":"\"\\s?}",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3go5pxe5lmmvpxiylh",
"constraints":"{\"searchTerms\":\"fw\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_l7profile_entry_id",
"preContext":"entry_id\":\\s",
"postContext":",\\s+\"action",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3mg5yhe33gnfwgkx3fnz2he6k7nfsa0000",
"constraints":"{\"searchTerms\":\"l7profile\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_l7profile_action",
"preContext":"action\":\\s+\"",
"postContext":"\"\\s?},",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3mg5yhe33gnfwgkx3bmn2gs33o",
"constraints":"{\"searchTerms\":\"l7profile\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_http_method",
"preContext":"http_method\":\\s+\"",
"postContext":"\",\\s+\"hostname",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3ior2hax3nmv2gq33e",
"constraints":"{\"searchTerms\":\"http\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_http_hostname",
"preContext":"hostname\":\\s+\"",
"postContext":"\",\\s+\"url",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3ior2hax3in5zxi3tbnvsq0000",
"constraints":"{\"searchTerms\":\"http\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_http_url",
"preContext":"url\":\\s+\"",
"postContext":"\",\\s+\"scheme",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3ior2hax3vojwa0000",
"constraints":"{\"searchTerms\":\"http\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_http_scheme",
"preContext":"scheme\":\\s+\"",
"postContext":"\",\\s+\"http_user_agent",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3ior2hax3tmnugk3lf",
"constraints":"{\"searchTerms\":\"http\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_http_user_agent",
"preContext":"http_user_agent\":\\s+\"",
"postContext":"\",\\s+\"status",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3ior2hax3vonsxex3bm5sw45a0",
"constraints":"{\"searchTerms\":\"http\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_http_status",
"preContext":"status\":\\s+\"",
"postContext":"\",\\s+\"site_category",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3ior2hax3torqxi5lt",
"constraints":"{\"searchTerms\":\"http\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_tls_action",
"preContext":"action\":\\s+\"",
"postContext":"\",\\s+\"rule_id",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3unrzv6yldoruw63q0",
"constraints":"{\"searchTerms\":\"tls_inspection\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_tls_rule_id",
"preContext":"rule_id\":\\s+",
"postContext":",\\s+\"domain",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3unrzv64tvnrsv62le",
"constraints":"{\"searchTerms\":\"tls_inspection\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_tls_domain",
"preContext":"domain\":\\s+\"",
"postContext":"\",\\s+\"cert_status",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3unrzv6zdpnvqws3q0",
"constraints":"{\"searchTerms\":\"tls_inspection\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_idps_action",
"preContext":"action\":\\s+\"",
"postContext":"\",\\s+\"rule_id",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3jmryhgx3bmn2gs33o",
"constraints":"{\"searchTerms\":\"idps\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_idps_rule_id",
"preContext":"rule_id\":\\s+",
"postContext":",\\s+\"ids_profile_id",
"regexValue":"-?\\d+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3jmryhgx3sovwgkx3jmq000000",
"constraints":"{\"searchTerms\":\"idps\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_app_id_app",
"preContext":"app\":\\s+\"",
"postContext":"\"\\s?}",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3bobyf62lel5qxa4a0",
"constraints":"{\"searchTerms\":\"app_id\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_antimalware_sha256",
"preContext":"filehash_sha256\":\\s+\"",
"postContext":"\",\\s+\"file_name",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3bnz2gs3lbnr3wc4tfl5zwqyjsgu3a0000",
"constraints":"{\"searchTerms\":\"antimalware\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_antimalware_file",
"preContext":"file_name\":\\s+\"",
"postContext":"\",\\s+\"file_size",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3bnz2gs3lbnr3wc4tfl5tgs3df",
"constraints":"{\"searchTerms\":\"antimalware\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_antimalware_verdic",
"preContext":"verdict\":\\s+\"",
"postContext":"\",\\s+\"action",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3bnz2gs3lbnr3wc4tfl53gk4tenfrq0000",
"constraints":"{\"searchTerms\":\"antimalware\"}",
"info":null
}, {
"displayName":"vmw_nsxt_ulog_antimalware_action",
"preContext":"action\":\\s+\"",
"postContext":"\",\\s+\"verdict_source",
"regexValue":"\\w+",
"internalName":"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vnrxwox3bnz2gs3lbnr3wc4tfl5qwg5djn5xa0000",
"constraints":"{\"searchTerms\":\"antimalware\"}",
"info":null
} ],
"queries":[ ],
"alerts":[ {
"name":"SysCpuUsage",
"info":"The CPU usage on NSX Manager or Edge node is very high.",
"recommendation":"Please review the configuration, running services and sizing of this Manager or Edge node. Consider adjusting the Manager or Edge appliance form factor size.",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"operator\":\"CONTAINS\",\"value\":\"manager_cpu_usage_very_high,edge_cpu_usage_very_high\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"operator\":\"CONTAINS\",\"value\":\"OPEN\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_alarm_state\",\"preContext\":\"alarmState=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_event_type\",\"preContext\":\"eventType=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"SysMemUsage",
"info":"The memory usage on NSX Manager or Edge node is very high.",
"recommendation":"Please review the configuration, running services and sizing of this Manager or Edge node. Consider adjusting the Manager or Edge appliance form factor size.",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"operator\":\"CONTAINS\",\"value\":\"manager_memory_usage_very_high,edge_memory_usage_very_high\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"operator\":\"CONTAINS\",\"value\":\"OPEN\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_alarm_state\",\"preContext\":\"alarmState=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_event_type\",\"preContext\":\"eventType=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"SysDiskUsage",
"info":"The disk usage for the NSX Manager or Edge node is very high.",
"recommendation":"Examine the partition with high usage and see if there are any unexpected large files that can be removed.",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"operator\":\"CONTAINS\",\"value\":\"manager_disk_usage_very_high,edge_disk_usage_very_high\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"operator\":\"CONTAINS\",\"value\":\"OPEN\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_alarm_state\",\"preContext\":\"alarmState=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_event_type\",\"preContext\":\"eventType=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"PasswordExpiry",
"info":"Password for appliance user account is about to expire or expired.",
"recommendation":"The password for user must be changed to access the system. For example, to apply a new password to a user, invoke the following NSX API with a valid password in the request body: PUT /api/v1/node/users/<userid> where <userid> is the ID of the user. If the admin user (with <userid> 10000) password has expired, admin must login to the system via SSH (if enabled) or console in order to change the password. Upon entering the current expired password, admin will be prompted to enter a new password.",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"operator\":\"CONTAINS\",\"value\":\"password_expired,password_is_about_to_expire\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"operator\":\"CONTAINS\",\"value\":\"OPEN\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_alarm_state\",\"preContext\":\"alarmState=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_event_type\",\"preContext\":\"eventType=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"CertificateExpiry",
"info":"One or more certificate is expired.",
"recommendation":"Ensure services that are currently using the certificate are updated to use a new, non-expired certificate. Once the expired certificate is no longer in use, it should be deleted. If the expired certificate is used by NAPP Platform, the connection is broken between NSX and NAPP Platform. Please check the NAPP Platform troubleshooting document to use a self-signed NAPP CA certificate for recovering the connection.",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"operator\":\"CONTAINS\",\"value\":\"certificate_expired\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"operator\":\"CONTAINS\",\"value\":\"OPEN\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_alarm_state\",\"preContext\":\"alarmState=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bnrqxe3k7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_event_type\",\"preContext\":\"eventType=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7or4xazi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"ClusterNodeStatus",
"info":"Local edge cluster node is down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXClusterNodeStatus\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^[3-9]|\\\\d{2,}$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"BackupFailure",
"info":"NSX scheduled backup operation failed.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"Cluster backup failed\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":false,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tgjrw63lq\",\"operator\":\"CONTAINS\",\"value\":\"backup-restore\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_s2comp\",\"preContext\":\"s2comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tgjrw63lq\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"VipLeadership",
"info":"NSX Management cluster VIP is down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"http\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP60401\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"ApiRateLimit",
"info":"Client API reached 80% of the configured threshold.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"http\"},{\"internalName\":\"text\",\"operator\":\"CONTAINS\",\"value\":\"New maximum of client API rate has exceeded 80% of the allowed limit.\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"CorfuQuorumLost",
"info":"Two nodes went down in the cluster and lost corfu quorum.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"cluster-boot-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"step\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"CBM38\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"DfwHeapMem",
"info":"DFW heap memory exceeded configured threshold.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-esx\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"agg-service\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MPA11015\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"ProcessStatus",
"info":"Critical process status changed.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXProcessStatus\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"ClusterFailoverStatus",
"info":"SR high availability state changed or active/standby services failover.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXClusterFailoverStatus\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^[1-9]|\\\\d{2,}$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"DhcpPoolUsageOverloadedEvent",
"info":"DHCP pool reached configured usage threshold.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXDhcpPoolUsageOverloadedEvent\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^1$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"FabricCryptoStatus",
"info":"Edge crypto mux driver is down for failing Known_Answer_Tests (KAT).",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXFabricCryptoStatus\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^[2-9]|\\\\d{2,}$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"VpnTunnelState",
"info":"VPN tunnel is down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXVpnTunnelState\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^0$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"BfdTunnelStatus",
"info":"BFD Tunnel status changed.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXBfdTunnelStatus\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^[3-9]|\\\\d{2,}$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"RoutingBgpNeighborStatus",
"info":"BGP neighbor status is down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXRoutingBgpNeighborStatus\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^0$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"VpnL2SessionStatus",
"info":"L2 VPN session is down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXVpnL2SessionStatus\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^0$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"VpnIkeSessionStatus",
"info":"IKE session is down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXVpnIkeSessionStatus\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^0$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"RoutingStatus",
"info":"Routing(BGP/BFD) is down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXRoutingStatus\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^0$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"DnsForwarderStatus",
"info":"DNS forwarder running status is DOWN.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"operator\":\"CONTAINS\",\"value\":\"vmwNSXDnsForwarderStatus\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"operator\":\"MATCH\",\"value\":\"^1$\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_event_state\",\"preContext\":\"\\\"event_state\\\":\\\\s?\",\"postContext\":\"(?:,|})\",\"regexValue\":\"\\\\S+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45c7on2gc5df\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"},{\"displayName\":\"vmw_nsxt_eventid\",\"preContext\":\"eventId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fozsw45djmq000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp NSX\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"TnConnDown_15min",
"info":"Transport Node connection to a controller/Manager is down for at least 15 minutes.",
"recommendation":"",
"alertType":"NEW_EVENT_TYPE",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-esx,nsx-edge,nsx-kvm\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"mpa,nsx-proxy\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MPA1009,MPA1011,PRX0803,PRX0105,PRX0805\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":900000,
"searchInterval":300000
}, {
"name":"TnConnDown_5min",
"info":"Transport Node connection to controller/Manager is down for at least 5 minutes.",
"recommendation":"",
"alertType":"NEW_EVENT_TYPE",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-esx,nsx-edge,nsx-kvm\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"mpa,nsx-proxy\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MPA1009,MPA1011,PRX0803,PRX0105,PRX0805\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":60000
}, {
"name":"ServiceDown",
"info":"One or more services are down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"heartbeatservice-server\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"ServiceMonitor\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"HBS153\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"IpNotAvailableInPool",
"info":"There is no IP available in the Pool or reaches configured threshold.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP5137,MP5109\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"LoadBalancerError",
"info":"NSX Load Balancer Service status is ERROR.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP7505\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"LoadBalancerDown",
"info":"NSX Load Balancer Service status is DOWN.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP7506\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"LoadBalancerVsDown",
"info":"VS status: all pool members are down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-edge\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-edge-lb.lb\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"EDG1200001\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"LoadBalancerPoolDown",
"info":"Pool status: all pool members are down.",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"startTimeMillis\":1560560370535,\"endTimeMillis\":1560560674224,\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-edge\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-edge-lb.lb\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"EDG1200000\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
}, {
"name":"ProcessCrash",
"info":"Process or daemon crashes in the datapath or other LB process like dispatcher, etc..",
"recommendation":"",
"alertType":"RATE_BASED",
"chartQuery":"{\"query\":\"\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"includeAllContentPackFields\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager,nsx-edge,nsx-autonomous-edge\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"node-mgmt\"},{\"internalName\":\"text\",\"operator\":\"CONTAINS\",\"value\":\"Core file generated\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"contentPacksToIncludeFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":"",
"hitCount":0.0,
"hitOperator":"GREATER_THAN",
"searchPeriod":300000,
"searchInterval":300000
} ],
"dashboardSections":[ {
"views":[
{
"name":"NSX - Infrastructure",
"constraints":[ ],
"rows":[
{"widgets":[
{
"name":"NSX Manager : Communication Errors",
"info":"These are all communication log errors on nsx-manager.<br><br>They are grouped by hostname.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"comp subcomp errorCode\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ANY\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"MPA(1[2-9]|20|1[0-1][0-9]|12[0-1]|13[0-39])\\\\b\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP228,MP236,MP239,MP40003,MP40005,MP40006,MP40007,MP40014,MP2109,MP2117,MP4002,MP4018,MP4021,MP4024,MP4035,MP4037,MP4038,MP4039,MP4040,MP4041,MP4042,MP4043,MP4052,MP4060,MP4069,MP4705,MP4709,MP2301,MP2302,CSM60306,CSM60310,MP211,MP217,MP254\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP5005,MP5605,MP5616,MP5618,MP3024,MP3025,MP4051,MP4058,MP4063,MP4065,MP4066,MP4067,MP2201,MP2203,MP2205,MP2206,MP2207,MP2208,MP2209,MP2213,MP2214,MP2215,MP2219,MP2221,MP2222,CSM60304,CSM60312,CSM60313,CSM60315,CSM60316,CSM60317,MP98,MP220,MP257\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP25007,MP25409\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP8244,MP8812\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MPA41542,MPA42063\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"nsxa[\\\\\\\\s\\\\\\\\S]*\"}],\"supplementalConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"hostname\",\"operator\":\"EXISTS\"}],\"groupByFields\":[{\"displayName\":\"hostname\",\"internalName\":\"hostname\",\"displayNamespace\":null,\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":""
},{
"name":"Transport Node - NSX Manager : Communication Errors",
"info":"Communication errors between NSX transport nodes (vSphere hosts, KVM hosts and NSX Edges) and NSX Manager. It is recommended to analyze the hostnames with the highest returned values to look for potential issues.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"errorCode\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ANY\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"EDG03[0-9]{4}\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"LCP0020[1-9]|LCP002[1-9][0-9]\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"MPA(1[2-9]|20|1[0-1][0-9]|12[0-1]|13[0-39])\\\\b\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"nsxa\"}],\"supplementalConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-esx,nsx-edge,nsx-kvm\"},{\"internalName\":\"hostname\",\"operator\":\"EXISTS\"}],\"groupByFields\":[{\"displayName\":\"hostname\",\"internalName\":\"hostname\",\"displayNamespace\":null,\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":""
}]}
,
{"widgets":[
{
"name":"Transport Node - Controller : Communication Errors",
"info":"Communication errors between NSX transport nodes (vSphere hosts, KVM hosts and NSX Edges) and NSX controllers. It is recommended to analyze the hostnames with the highest returned values to look for potential issues.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"errorCode\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ANY\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"LCP0000[1-9]|LCP000[1-9][0-9]\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"LCP0020[1-9]|LCP002[1-9][0-9]\"}],\"supplementalConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-esx,nsx-edge,nsx-kvm\"},{\"internalName\":\"hostname\",\"operator\":\"EXISTS\"}],\"groupByFields\":[{\"displayName\":\"hostname\",\"internalName\":\"hostname\",\"displayNamespace\":null,\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
},{
"name":"Controller : Communication Errors",
"info":"Communication errors among controllers in a cluster. It is recommended to analyze the hostnames with the highest returned values to look for potential issues.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"errorCode\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ANY\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"CCP1910040, CCP2010060, CCP2010070\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"MPA(1[2-9]|20|1[0-1][0-9]|12[0-1]|13[0-39])\\\\b\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"operator\":\"CONTAINS\",\"value\":\"zookeeper,replication,moot-client,moot-cluster,lcp-channel,lcp-session,adapter-mp\"}],\"supplementalConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-controller\"},{\"internalName\":\"hostname\",\"operator\":\"EXISTS\"}],\"groupByFields\":[{\"displayName\":\"hostname\",\"internalName\":\"hostname\",\"displayNamespace\":null,\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_subcomp\",\"preContext\":\"subcomp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3tovrgg33noa000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp\\\"}\"}]}",
"messageQuery":""
}]}
,
{"widgets":[
{
"name":"Configuration Errors",
"info":"This widget is based on known error patterns generated from various components that create the NSX infrastructure. It is recommended to analyze the hostnames with the highest returned values to look for potential issues.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"errorCode\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ANY\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"LCP0000[1-9]|LCP000[1-9][0-9]\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"EDG01[0-9][0-9][0-9][0-9]\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"ESX[0-9]+\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"CCP0110690,CCP0110700,CCP0110710,CCP1910010,CCP1910030,CCP2010130,CCP2010140,CCP0110400,CCP0110540,CCP0110550,CCP0110560,CCP0110570,CCP0110580,CCP0110590,CCP0910020\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"LCP0100006,LCP0101002,LCP0106004\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"MP2500[0-8]\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP25100\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"MP254[0-2][0-9]\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"MP253[0-1][0-9]|MP2532[0-4]\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"MP255[0][0-9]|MP2551[0-1]\"}],\"supplementalConstraints\":[{\"internalName\":\"hostname\",\"operator\":\"EXISTS\"}],\"groupByFields\":[{\"displayName\":\"hostname\",\"internalName\":\"hostname\",\"displayNamespace\":null,\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
},{
"name":"Other Errors",
"info":"Other errors from all NSX components. It is recommended to analyze the hostnames with the highest returned values to look for potential issues. Host agent failures, such as nsx-cfgagent down or MPA down, may require immediate action.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"errorCode\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ANY\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"ESX[0-9]+\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"MPA13[4-8]|MPA12[2-9]|MPA130|MPA14[0-3]|MPA100[0-9]|MPA101[0-9]|MPA102[0-7]\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"CONTAINS\",\"value\":\"MP25431,MP25421,MP25415\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"operator\":\"MATCH\",\"value\":\"EDG07[0-9]{4}\"}],\"supplementalConstraints\":[{\"internalName\":\"hostname\",\"operator\":\"EXISTS\"}],\"groupByFields\":[{\"displayName\":\"hostname\",\"internalName\":\"hostname\",\"displayNamespace\":null,\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_error_code\",\"preContext\":\"errorCode=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fojzg64s7mnxwizi0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
}]}
]
}
,{
"name":"NSX - Audits - Overview",
"constraints":[ ],
"rows":[
{"widgets":[
{
"name":"Logical Switch Audits",
"info":"Logical switch messages excerpted from the NSX audit log capturing any create, update, or delete events.<br><br>Note - events may be duplicated as they are generated in multiple NSX loggers. Thus, this widget will provide a general count of logical switch audit events.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"comp\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":false,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"NSX\"},{\"internalName\":\"msgid\",\"operator\":\"CONTAINS\",\"value\":\"SWITCHING\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"operator\":\"CONTAINS\",\"value\":\"CreateLogicalSwitch,UpdateLogicalSwitch,DeleteLogicalSwitch\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"operator\":\"CONTAINS\",\"value\":\"success\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_operation\",\"preContext\":\"Operation(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_audit_operation_status\",\"preContext\":\"status(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
},{
"name":"Logical Switch Audit Details",
"info":"All logical switch audit events. This widget is based on known error patterns generated from various components that create the NSX logical switch infrastructure.",
"gridWidth" : "1/2",
"chartType":"number",
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"comp\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"NSX\"},{\"internalName\":\"msgid\",\"operator\":\"CONTAINS\",\"value\":\"SWITCHING\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"operator\":\"CONTAINS\",\"value\":\"CreateLogicalSwitch,UpdateLogicalSwitch,DeleteLogicalSwitch\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"operator\":\"CONTAINS\",\"value\":\"success\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"operator\":\"EXISTS\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"operator\":\"EXISTS\"}],\"supplementalConstraints\":[],\"groupByFields\":[{\"displayName\":\"vmw_nsxt_user\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null},{\"displayName\":\"vmw_nsxt_operation\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null},{\"displayName\":\"vmw_nsxt_entid\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_audit_operation_status\",\"preContext\":\"status(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_entid\",\"preContext\":\"entId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"NSX comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_operation\",\"preContext\":\"Operation(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_user\",\"preContext\":\"UserName(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\".+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
}]}
,
{"widgets":[
{
"name":"Logical Switch Port Audits",
"info":"Logical switch port messages excerpted from the NSX audit log capturing any create, update, or delete events.<br><br>Note - events may be duplicated as they are generated in multiple NSX loggers. Thus, this widget will provide a general count of logical switch port audit events.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"comp\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":false,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"NSX\"},{\"internalName\":\"msgid\",\"operator\":\"CONTAINS\",\"value\":\"SWITCHING\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"operator\":\"CONTAINS\",\"value\":\"CreateLogicalPort,UpdateLogicalPort,DeleteLogicalPort\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"operator\":\"CONTAINS\",\"value\":\"success\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_operation\",\"preContext\":\"Operation(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_audit_operation_status\",\"preContext\":\"status(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
},{
"name":"Logical Switch Port Audit Details",
"info":"All logical switch port audit events. This widget is based on known error patterns generated from various components that create the NSX logical switch infrastructure.",
"gridWidth" : "1/2",
"chartType":"number",
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"comp\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"NSX\"},{\"internalName\":\"msgid\",\"operator\":\"CONTAINS\",\"value\":\"SWITCHING\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"operator\":\"CONTAINS\",\"value\":\"CreateLogicalPort,UpdateLogicalPort,DeleteLogicalPort\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"operator\":\"CONTAINS\",\"value\":\"success\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"operator\":\"EXISTS\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"operator\":\"EXISTS\"}],\"supplementalConstraints\":[],\"groupByFields\":[{\"displayName\":\"vmw_nsxt_user\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null},{\"displayName\":\"vmw_nsxt_operation\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null},{\"displayName\":\"vmw_nsxt_entid\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_audit_operation_status\",\"preContext\":\"status(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_entid\",\"preContext\":\"entId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"NSX comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_operation\",\"preContext\":\"Operation(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_user\",\"preContext\":\"UserName(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\".+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
}]}
,
{"widgets":[
{
"name":"Logical Router Audits",
"info":"Logical router messages excerpted from the NSX audit log capturing any create, update, or delete events.<br><br>Note - events may be duplicated as they are generated in multiple NSX loggers. Thus, this widget will provide a general count of logical router audit events.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"comp\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":false,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"NSX\"},{\"internalName\":\"msgid\",\"operator\":\"CONTAINS\",\"value\":\"ROUTING\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"operator\":\"CONTAINS\",\"value\":\"CreateLogicalRouter,UpdateLogicalRouter,DeleteLogicalRouter\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"operator\":\"CONTAINS\",\"value\":\"success\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_operation\",\"preContext\":\"Operation(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_audit_operation_status\",\"preContext\":\"status(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
},{
"name":"Logical Router Audit Details",
"info":"All logical router audit events. This widget is based on known error patterns generated from various components that create the NSX logical routing infrastructure.",
"gridWidth" : "1/2",
"chartType":"number",
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"comp\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"NSX\"},{\"internalName\":\"msgid\",\"operator\":\"CONTAINS\",\"value\":\"ROUTING\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"operator\":\"CONTAINS\",\"value\":\"CreateLogicalRouter,UpdateLogicalRouter,DeleteLogicalRouter\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"operator\":\"CONTAINS\",\"value\":\"success\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"operator\":\"EXISTS\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"operator\":\"EXISTS\"}],\"supplementalConstraints\":[],\"groupByFields\":[{\"displayName\":\"vmw_nsxt_user\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null},{\"displayName\":\"vmw_nsxt_operation\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null},{\"displayName\":\"vmw_nsxt_entid\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_audit_operation_status\",\"preContext\":\"status(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_entid\",\"preContext\":\"entId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"NSX comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_operation\",\"preContext\":\"Operation(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_user\",\"preContext\":\"UserName(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\".+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
}]}
,
{"widgets":[
{
"name":"Logical Router Port Audits",
"info":"Logical router port messages excerpted from the NSX audit log capturing any create, update, or delete events.<br><br>Note - events may be duplicated as they are generated in multiple NSX loggers. Thus, this widget will provide a general count of logical router port audit events.",
"gridWidth" : "1/2",
"chartType":null,
"chartOptions":"{}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"comp\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":false,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"NSX\"},{\"internalName\":\"msgid\",\"operator\":\"CONTAINS\",\"value\":\"ROUTING\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"operator\":\"CONTAINS\",\"value\":\"CreateLogicalRouterPort,UpdateLogicalRouterPort,DeleteLogicalRouterPort\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"operator\":\"CONTAINS\",\"value\":\"success\"}],\"supplementalConstraints\":[],\"groupByFields\":[],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_operation\",\"preContext\":\"Operation(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_audit_operation_status\",\"preContext\":\"status(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
},{
"name":"Logical Router Port Audit Details",
"info":"All logical switch port audit events. This widget is based on known error patterns generated from various components that create the NSX logical router infrastructure.",
"gridWidth" : "1/2",
"chartType":"number",
"chartOptions":"{\"logaxis\":false,\"legend\":true,\"stacking\":\"normal\",\"spline\":false}",
"widgetType":"chart",
"chartQuery":"{\"query\":\"comp\",\"piqlFunctionGroups\":[{\"functions\":[{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false}],\"field\":null}],\"dateFilterPreset\":\"CUSTOM\",\"shouldGroupByTime\":true,\"eventSortOrder\":\"DESC\",\"summarySortOrder\":\"DESC\",\"compareQueryOrderBy\":\"TREND\",\"compareQuerySortOrder\":\"DESC\",\"compareQueryOptions\":null,\"messageViewType\":\"EVENTS\",\"constraintToggle\":\"ALL\",\"piqlFunction\":{\"label\":\"Count\",\"value\":\"COUNT\",\"requiresField\":false,\"numericOnly\":false},\"piqlFunctionField\":null,\"fieldConstraints\":[{\"internalName\":\"appname\",\"operator\":\"CONTAINS\",\"value\":\"NSX\"},{\"internalName\":\"msgid\",\"operator\":\"CONTAINS\",\"value\":\"ROUTING\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"operator\":\"CONTAINS\",\"value\":\"nsx-manager\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"operator\":\"CONTAINS\",\"value\":\"CreateLogicalRouterPort,UpdateLogicalRouterPort,DeleteLogicalRouterPort\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"operator\":\"CONTAINS\",\"value\":\"success\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"operator\":\"EXISTS\"},{\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"operator\":\"EXISTS\"}],\"supplementalConstraints\":[],\"groupByFields\":[{\"displayName\":\"vmw_nsxt_user\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null},{\"displayName\":\"vmw_nsxt_operation\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null},{\"displayName\":\"vmw_nsxt_entid\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"displayNamespace\":\"Unknown\",\"numericGroupByType\":\"EACH_VALUE\",\"numericGroupByValue\":null}],\"extractedFields\":[{\"displayName\":\"vmw_nsxt_audit_operation_status\",\"preContext\":\"status(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3bovsgs5c7n5ygk4tboruw63s7on2gc5dvom000000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_comp\",\"preContext\":\"comp=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3dn5wxa000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_entid\",\"preContext\":\"entId=\\\"\",\"postContext\":\"\\\"\",\"regexValue\":\"\\\\S+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3fnz2gsza0\",\"constraints\":\"{\\\"searchTerms\\\":\\\"NSX comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_operation\",\"preContext\":\"Operation(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\"\\\\w+\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3pobsxeylunfxw4000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"},{\"displayName\":\"vmw_nsxt_user\",\"preContext\":\"UserName(?::'|=\\\")\",\"postContext\":\"(?:'|\\\")\",\"regexValue\":\".+?\",\"internalName\":\"ibadcnk7mnxw2ltwnv3wc4tffzxhg6duozwxox3oon4hix3vonsxe000\",\"constraints\":\"{\\\"searchTerms\\\":\\\"comp subcomp\\\"}\"}]}",
"messageQuery":""
}]}