Based on this in the man page:
Note that match variables may be used in the context and cfset fields.
I assumed this would work:
type=Jump
ptype=PerlFunc
pattern=sub { if (defined $WINDOWS{SourceName} and length $WINDOWS{SourceName})
{
$WINDOWS{_jump_cfset} = "windows_\L$WINDOWS{SourceName}" } else {
$WINDOWS{_jump_cfset} =
"windows_unclassified" } return \%WINDOWS }
cfset=$+{_jump_cfset}
However, this does not seem to work as expected:
Thu Jun 18 11:21:33 2015: Can't jump to fileset '$+{_jump_cfset}' from
/etc/sec/windows.log.rules, set does not exist
Should it?
Thanks,
Mark
--
Mark D. Nagel, CCIE #3177 Emeritus <[email protected]>
Principal Consultant, Willing Minds LLC (http://www.willingminds.com)
cell: 949-279-5817, desk: 714-495-4001, fax: 714-844-4698
** For faster support response time, please
** email [email protected] or call 714-495-4000
------------------------------------------------------------------------------
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
