Expressions

Windows events provide a prompt in the expression dialog box to select individual properties so you will typically not have to understand the actual syntax. The list of properties with their description is at Windows Events.

Event Description is not included in the dropdown list for property name. It can be used by typing in EventDescription. Before using Event Description though, you should verify whether the information that you are using in the description is available in parameters. Event descriptions are often made up of standard text with unique information included through parameters. Parameters are more efficient that the full description since they contain a specific piece of information.

Text Logs do not provide a prompt for the parameter name, so you need to type it in using the appropriate syntax. There are two types of text logs: Generic Text Logs where each line is processed as a single entry and Generic CSV Text Logs which use a delimiter to separate the fields of each entry.

For a Generic Text Log, the entire entry is referred to with a single parameter using the following syntax:

Params/Param[1]

For a Generic CSV Text Log, each field of the entry is referred to with a separate parameter for each field of the entry using the following syntax where # refers to the number of the field starting with 1:

Params/Param[#]

Further details on text log expressions are available at Event Expression.

WMI Events do not provide a prompt for the parameter name, so you need to type it in using the appropriate syntax.

The properties available for a WMI event will vary, depending on the kind of event being monitored. The data will be in the form of a property bag that has a collection of properties for one or more WMI class instances. WMI events created by using a query that uses either __InstanceCreationEvent or __InstanceDeletionEvent will have a single collection called TargetInstance with the instance being either created or deleted. WMI events created by using __InstanceModificationEvent will have an additional collection called PreviousInstance.

The syntax for properties from a WMI event is as follows:

Collection[@Name='TargetInstance']/Property[@Name='Caption']

Further details on WMI Events are available at WMI Events.

Syslog Events do not provide a prompt for the parameter name, so you need to type it in using the appropriate syntax. The syntax for the properties of a syslog event is simply the name of the property. These properties are listed in Syslog Events.

SNMP probes and traps do not provide a prompt for the parameter name, so you need to type it in using the appropriate syntax. The syntax for the properties in the header of an SNMP probe or trap is simply the name of the property.

When a single OID is used:

SnmpVarBinds/SnmpVarBind/ElementName

When you have multiple OIDs and want to refer to each by its numeric order. The first OID is 1, the second is 2, and so on:

SnmpVarBinds/SnmpVarBind[#]/ElementName

When you have multiple OIDs and want to refer to each by the specific OID:

SnmpVarBinds/SnmpVarBind[OID="OID"]/ElementName

Further details on SNMP events are listed in SNMP Events.

Scripts do not provide a prompt for the parameter name, so you need to type it in using the appropriate syntax. Monitoring scripts output information in the form of a property bag that includes one or more values. The parameter specifies the name of one of the values from the property bag using the following syntax:

Property[@Name="PropertyName"]

Further details on monitoring scripts are available at Script Monitors and Rules.