Hi Andrew,
You can use 'eval' action to reformat the $1 timestamp. Same perl code (except
you need %% for month_hash):
eval %time ( my $str = "$1";\
my
@months=('jan','feb','mar','apr','may','jun','jul','aug','sep','oct','nov','dec');\
my ($day,$mon,$date,$year,$time) = split(' ',lc($str));\
my %%month_hash;\
@month_hash{@months} = (1 .. 12);\
return "$year-$month_hash{$mon}-$date $time";\
)
Regards,
Rock
From: andrewarnier [mailto:[email protected]]
Sent: Friday, November 21, 2014 1:26 AM
To: [email protected]
Subject: [Simple-evcorr-users] how to get pattern variable $1 to action ?
Hi all,
I want to get the trap time ,but the trap time format is "Fri Nov 21 2014
15:04:32" ,how to change the format to "2014-11-21 15:04:32" in my single rule
?
I try to convert the datetime format in my sec fule, but my rule action can't
get the variable $1,
Anyone knows what's wrong with my rule ? how to fix ?
type=Single
ptype=Regexp
pattern=(\S+) .1.3.6.1.4.1.3607.2.20.0.430 192.168.11.15 Loss Of Signal in
(\S+) \(criticalServiceAffecting\),ifIndex=(.+)
desc= CA -15600 Loss of signal events for interface $2($3)
action=lcall %time -> ( sub { my $str = '$1';\
my @months
=('jan','feb','mar','apr','may','jun','jul','aug','sep','oct','nov','dec');\
my ($day,$mon,$date,$year,$time) = split(' ',lc($str));\
my %month_hash;\
@month_hash{@months} = (1 .. 12);\
return "$year-$month_hash{$mon}-$date $time"; } );shellcmd
/home/andrew/code/sendmail.sh "Loss Of Signal" "CA-15600 Loss of signal events
for interface $2($3)" "%time"
cheers,
Andrew
------------------------------------------------------------------------------
Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
