BigPanda Formula Language (BPFL)

BigPanda Formula Language enables the use of complex calculations when configuring automatic enrichment tags.

Automatic Enrichment Tags are able to use formula calculations when adding Incident Tags to allow for deeper detail and context. The updated BigPanda Formula Language allows greater precision and detail in configuring your automatic enrichment formulas.

Functions and variables within the formula language are similar to those of Microsoft Excel, and are sophisticated enough to support tag enrichment rules that depend on the results of other alert or incident tags.

Creating and Editing Formulas

Formulas can be added or edited through the new Incident Tag Automatic Enrichment editor.

In the Automatic Enrichment field, you’ll have the option to set a Condition and Value.

BigPanda Formula EditorBigPanda Formula Editor

BigPanda Formula Editor

Note: Leave the Condition field blank if you would like the Value formula to run on every new incident.

Enter a formula in the Value field to have the system run a calculation based on the functions and attributes on each qualifying incident and then apply the correct tags based on that calculation.

BigPanda formulas are able to pull alert and incident data, and perform multi-factor functions in addition to standard mathematical operators.

With the exception of the Unique function, BigPanda Formula Language is case insensitive.

📘

In BPFL, you are able to use spaces between formula elements.

Incident Data

BigPanda Formula Language allows you to retrieve alerts and incident data as part of the formula. There are two key methods to pulling incident data into formulas: Alert Tags and Incident Metadata. Both methods require specific syntax and should be contained in braces.

Alert Tags

Use a specified alert tag type to pull an array of values from all alerts in the incident. The available tags you can enter here are determined by the alert tags configured in your system.

Syntax
{alert_tags.tagName}

For example, if you entered:
{alert_tags.host}
the system would add an array of the host tags for each alert into the formula

Incident Metadata

Use incident metadata to pull a value or array from a specific field in the BigPanda incident data.

Available Metadata Tags:

  • id - returns a string containing the ID of the incident
  • source_system - returns an array with all the integration IDs of the alerts
  • status - returns the current status of the incident (“Critical”, “Warning“, ”Unknown“, ”Ok“)
  • number_of_alerts - returns the number of alerts in an incident
  • is_flapping - returns true if the incident is in a flapping state, otherwise, returns false
  • is_snoozed - returns true if the incident is snoozed, otherwise, returns false

Syntax
{incident.metadataField}

For example, if you entered:
{incident.status}
the system would enter the incident status into the formula

Functions

Most formulas are centered in functions, or preset calculation types, with operators to modify the functions. The supported functions in BigPanda are COUNT, UNIQUE, and IF. These functions can be combined together to create more complex formulas. Each function runs a calculation on information entered between following parenthesis.

COUNT

The COUNT function adds up the total number of incoming values.

Syntax
COUNT(array)

For example, if you entered:
COUNT([1, 2, 3, 3])
the system would return 4

UNIQUE

The UNIQUE function returns a list of all unique values for incoming items. The Unique function is case sensitive.

Syntax
UNIQUE(array)

For example, if you entered:
UNIQUE([1, 2, 3, 3])
the system would return [1, 2, 3]

IF

The IF function sets a condition. If the condition is met, the first value will be returned. (Optional) Add a second value to return if the condition is not met. You can nest IF functions to create logic chains.

Syntax
IF(LogicalArgument, value1, value2)
IF(LogicalArgument,value1)

For example, if you entered:
IF(1 < 2, "true", "false")
the system would return “true”

Logical Operators

Logical Operators are additional modifiers that allow you to use the functions to create more complex calculations.

Operator

Description

Example

=

Equal

1 = 2
==> false

!=

Not Equal

1 != 2
==> true

Greater Than

1 > 2
==> false

<

Less Than

1 < 2
==> true

=

Greater Than or Equal

1 >= 2
==> false

<=

Less Than or Equal

1 <= 2
==> true

OR
or

At least one of the conditions is true

1 <= 2 OR 1 = 2
==> true

AND
and

All of the conditions are true

1 <= 2 AND 1 = 2
==> false

Example Formula

These elements can be combined together to create sophisticated formulas to improve workflows, such as:

IF(COUNT(UNIQUE({alert_tags.service})) > 3 AND {incident.status} = "Critical", ">3 affected services", "<=2 affected services")

In this formula IF the COUNT of UNIQUE alert service tags is greater than three AND the incident status is “Critical”, then the “>3 affected services” tag will be added to the incident. If the count is less than three, or the incident status is not “Critical”, then the “<=2 affected services” tag will be added to the incident.