6 Replies Latest reply on Nov 16, 2017 10:28 AM by Charles Kelley

    MRL matches_regex

    Brian Morris

      I am trying to write a rule that grabs a regex match out of a field and places the result in another field.  The issue is that I can't seem to make the regex match amything so my list ends up empty and my enrichment slot is still null after processing.  I've validated my regex in RegexCoach and on this site: http://retester.herokuapp.com/

      The site indicates that there is a match.  The rule compiles (this is for 9.6) and fires against a test event, but the regex doesn't seem to match for BPPM.


      Any assistance would be great!


      This is my code:


      refine SMARTS_Correlation_Key:

      SMARTS ($EV)

      where [ $EV.status equals OPEN AND $EV.SMARTS_ElementName not_equals NULL AND $EV.severity >= "INFO" ]



      $Prefix_list = match_regex($EV.SMARTS_ElementName,'.*(?=-[^-]+)','is',1);


      $LEN = listlen($Prefix_list);

      opadd($EV,'LEN= ' || $LEN,'');


      if $LEN >= 1 then {

      $EV.SMARTS_Prefix = listgetelt($Prefix_list,1);

      opadd($EV, 'Set SMARTS Correlation Prefix: ' || $EV.SMARTS_Prefix,'');






      Some data and desired outcome:

      Input:  infra-d113-mot.mft.com

      Desired output:  infra-d113


      Input:  infra-p465-fra.web.com

      Desired output:  infra-p465

        • 1. Re: MRL matches_regex
          Charles Kelley

          You don't necessarily need match_regex for this one.


          You can try this:


          $EV.SMARTS_Prefix = substring($EV.SMARTS_ElementName, 0, strnpart( $EV.SMARTS_ElementName, '-', 2) - 1);



          1 of 1 people found this helpful
          • 2. Re: MRL matches_regex
            Brian Morris



            Thanks for responding and providing that idea.  It doesn't quite work though... it doesn't set the slot and throws cell errors:


            Error 488 occurred during processing of event xxxxx ***BUILTIN 488*** is32/2: Function substring/3 : out of range


            This works a bit better in that it sets the slot value correctly, but it still throws that same cell error as above.  Any idea of what's going wrong?


            $EV.SMARTS_Prefix = substring($EV.SMARTS_ElementName,0,(strnpart($EV.SMARTS_ElementName,'-',2)-1));




            In the Error event, the Goal is this function in this rule, but I'm not sure how to interpret the rest of the message.  It says:


            Error Goal:  refine__SMARTS_correlations__SMARTS_Correlation_Key(SMARTS,0x91a4dc8)

            1 of 1 people found this helpful
            • 3. Re: MRL matches_regex
              Charles Kelley

              Without seeing the tracing, you might need an if/then wrapper around that call to make sure it would only operate on events with at least two hyphens in the SMARTS_ElementName.  With a substring out of range error, I suspect that perhaps certain events are coming in without that format in this slot, thus the strnpart doesn't find the second hyphen, meaning that the range for the substring call is invalid.



              • 4. Re: MRL matches_regex
                Brian Morris

                OK so the old template applies:


                $ZPOS = strnpart($E.mc_host,'.',2);

                if ( $HLEN == 0 OR $ZPOS == 0 OR $ZPOS == $HLEN ) then

                $E.mc_location = "Unknown";

                else ....


                Whoever wrote that snippet should get a nickle for every time it's used


                Is this where the regex might be superior or is it functionally the same?  I'm disappointed I couldn't get the regex match working because it'd be cool to test for the match, if it's a match then assign the value of whatever matched first. 

                1 of 1 people found this helpful
                • 5. Re: MRL matches_regex
                  Brian Morris

                  Adding the error checking in worked and the code sets the value in the slot I need.  Thanks for the help Charles!

                  • 6. Re: MRL matches_regex
                    Charles Kelley

                    One final note, if you did want to do it with match_regex, you can use this:


                    $Prefix_list = match_regex($EV.SMARTS_ElementName,'^(\S+\-\S+)\-','');



                    1 of 1 people found this helpful