SAFL (RTC)

Streaming Correlator uses its own SAFL dialect, SAFL (RTC), for rule conditions. An expression in this dialect is evaluated for every incoming event and returns a Boolean value: true or false. SAFL (RTC) includes most standard SAFL functions and extends them with functions designed for streaming event processing.

Where It Is Used

SAFL (RTC) expressions are configured in the following fields of the rule and active list editors:

• Firing Condition of a declarative rule, evaluated for every event. See Declarative Rules
• Pre-filter of an aggregation rule and Filter of an individual metric. See Aggregation Rules
• Firing Condition of an aggregation rule, which operates on metric names rather than event fields
• Pre-filter of an imperative rule, Condition of an Event stage, and Event That Cancels the Incident of an Absence stage. See Imperative Rules
• Stream Filter of an active list, which selects events for automatic population. See Active Lists

All these fields except the Firing Condition of an aggregation rule are evaluated against incoming event fields. Otherwise, the dialect behaves consistently regardless of which field contains the expression.