Hi
Hans-Joerg Wagner wrote:
> I have to deal with eventlogs containing entries like this:
> ** Event: 1240: 012 09:54:21 06.02 RB:Bat test fail 12999
>
> Where we define the 1240 as sequence number.
>
>
>
<SNIP>
> # ------------------------------------------------------------- START OF RULE
> -
> # rule selection
> type=single
> desc=RB:Bat test fail
> ptype=regexp
> pattern=le.*Event:.*
> context=trig_rb_bat_test_fail
> action=eval %o ( \
> foreach $eventline (@{$val = \
> $main::context_list{trig_rb_bat_test_fail}->{"Buffer"}}) {\
> $eventline =~ /.*Event: 0*(\d+).*/; \
> print "$1\n"; \
> } \
> )
>
> # --------------------------------------------------------------- END OF RULE
> -
>
I believe that you'll need to double the $s on the local perl variables
in the eval for this to work. Take a look at this example rule.
type=SingleWithSuppress
ptype=RegExp
pattern=^[0-9\/ :]+(.+failed.*)
desc=FAILED:$1
action=eval %fstub ($$f = $$main::input_sources[$$main::bufpos];\
$$f =~ s|\x5C|/|g;\
$$f =~ s|.*/(\w+)[^/]*$|$$1|;\
return "Unknown" unless $$f;\
return $$f;);
window=6000
------------------------------------------------------------------------------
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
