hi Mark, since in many configurations fileset labels are constants, they are not searched for match variables by default, in order to make Jump rules more efficient. However, if you add the following field to your rule definition
constset=no the match variables are substituted (the default value for 'constset' field is 'yes' which disables the match variable substitution for the 'cfset' field). This behavior is also documented in the very first paragraph of the Jump rule section, but it should also be emphasized in the place you mentioned in your e-mail. I'll add this documentation fix to my TODO list. kind regards, risto 2015-06-18 21:23 GMT+03:00 Mark D. Nagel <[email protected]>: > Based on this in the man page: > > Note that match variables may be used in the context and cfset > fields. > > I assumed this would work: > > type=Jump > ptype=PerlFunc > pattern=sub { if (defined $WINDOWS{SourceName} and length > $WINDOWS{SourceName}) { > $WINDOWS{_jump_cfset} = "windows_\L$WINDOWS{SourceName}" } else { > $WINDOWS{_jump_cfset} = > "windows_unclassified" } return \%WINDOWS } > cfset=$+{_jump_cfset} > > However, this does not seem to work as expected: > > Thu Jun 18 11:21:33 2015: Can't jump to fileset '$+{_jump_cfset}' from > /etc/sec/windows.log.rules, set does not exist > > Should it? > > Thanks, > Mark > > -- > Mark D. Nagel, CCIE #3177 Emeritus <[email protected]> > Principal Consultant, Willing Minds LLC (http://www.willingminds.com) > cell: 949-279-5817, desk: 714-495-4001, fax: 714-844-4698 > > ** For faster support response time, please > ** email [email protected] or call 714-495-4000 > > > > ------------------------------------------------------------------------------ > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users >
------------------------------------------------------------------------------
_______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
