Introduction 

RapidCMDB and products based on RapidCMDB, such as RapidInsight for Netcool (RI4NC) and RapidInsight for Smarts (RI4S) - generally referred to as RapidSuite products - have a powerful search support built on Grails Searchable plugin for compass which in turn uses Apache Lucene. Based on the Lucene terminology, you can use terms (single words) or phrases (group of words surrounded by double quotes such as "server down") in your searches. Terms and phrases are combined with boolean operators.

The default logical operator for RapidSuite products is AND. That is, you can omit AND and a space will be interpreted as an AND between terms/phrases.

RI4NC contains NetcoolEvent and Journal modeled classes with various fields. While searching, you can use terms or phrases without specifying any field. RI4NC will scan all fields and retrieve objects that match the term/phrase in any field. Following query string will retrieve all objects that have "router1" in any one of its fields.

router1

However, you can restrict searches to specific fields by specifying the fieldname. In the following example, we are searching for events that have teh value "Root" for the owneruid field:

owneruid:Root

Refining Searches at the UI 

Your best documentation is actually the search text field on the RI4NC UI. As you select property values, you will see that your selections will be appended to the search criteria, refining your searches. These additional terms or phrases are ANDed with the existing search criteria.

Refine your searches and observe how RI4NC constructs search strings to use them as examples for your searches. As an example, click on the "Critical Events" saved query under the "By Severity" query group. The following query string will be shown in the query text field:

severity:5

This query will retrieve all critical events with severity 5. Any field of each event in the result list can be used for refinement. For example, click on the acknowledged=Yes link and this will append this condition to the existing query string:

severity:5 acknowledged:"Yes"

It will now retrieve critical events that are acknowledged.

owneruid is another field of Event. Select the dropdown menu for the owneruid field on any one of the records, for example: owneruid:Root, and select "except" from the menu. This will modify the query as folows:

severity:5 acknowledged:"Yes" NOT owneruid: "Root"

This query will retrieve all acknowledged critical events whose owneruid is DIFFERENT from Root.

You can play with the RI4NC UI either at: "http://www.ifountain.com/rapidinsight/demo", our online demo site or with your own installation.  

Boolean Operators

RI4NC supports the following boolean operators:

• AND (default operator, can be omitted)
• OR
• NOT

  These operators must be uppercase in your query strings!

Grouping

Terms/phrases can be grouped:

(Router OR Switch) AND Down

The grouping can also be used with fields:

severity:(2 OR 3)  AND owneruid:Root

Range Searches

You can specify lower and upper bounds while entering your query. Upper and lower bounds can be inclusive or exclusive. Here is how an inclusive range is specified:

severity:[1 TO 5]

In order to exclude the bounds, enter the query string as:

severity:{1 TO 5}

Less Than, Greater Than, etc...

Lucene search syntax does not support less than, greater than operators but range searches  can be used for this purpose. Lets assume that we have a field called Severity which can have values between 1 and 5 (inclusive). Here is how we can use range searches for searching fields with values less than or greater than a certain value:

Wildcard Searches

Single and multiple character wildcard searches are supported:

owneruid:Ro* // multiple characters
owneruid:R*t // multiple characters
owneruid:Roo? // single character
owneruid:Ro?t // single character

Fuzzy Searches

RI4NC supports fuzzy searches:

owneruid:Boot~

The above example will match Root for the owneruid.