Update batch rule properties from input records. Only the fields a record carries are changed, and an empty value clears the field.

Input record:

• guid (required) - Target rule GUID
• name (optional) - Rule name. A duplicate name is rejected
• description (optional) - Free-text description
• msg (optional) - Event title template. $field inserts a log field value, e.g. SSH: $src_ip -> $dst_ip
• priority (optional) - LOW, MEDIUM or HIGH
• schedule (optional) - Cron expression, e.g. */10 * * * *
• duration (optional) - Query window in seconds
• datetrunc (optional) - Timestamp truncation unit in seconds
• dataset_guid (optional) - Dataset GUID
• category_guid (optional) - Category GUID
• ticket_repo_guid (optional) - Ticket repository GUID
• suppress_key (optional) - Suppression key template, e.g. $src_ip$dst_ip. One event per distinct combination
• event_suppress_interval (optional) - Event suppression window in seconds
• ticket_suppress_interval (optional) - Ticket suppression window in seconds
• keep_alive (optional) - true or false
• enabled (optional) - true or false

name, msg, priority and schedule cannot be cleared. Use sonar-update-batch-rule-query-batch to change the query itself.

run=VALUE

Optional. Update rule only if value is 't'

Output Fields