Here you have one of my simulair working examples as reference. Keep up the
good work!
/Roberth
0xfff00001 E 50 P "CreateEventWithAttributes( \
{ C CURRENT_MODEL }, \
{ H 0xfff00002 }, \
SetEventAttribute( \
SetEventAttribute( \
SetEventAttribute( \
SetEventAttribute( \
SetEventAttribute( \
GetEventAttributeList(), \
{ U 16 }, \
GetRegexp( \
GetEventAttribute( { U 4 } ), \
{ S \"(.*?)\/.*\" }, \
{ U 1 } \
) \
), \
{ U 142 }, \
GetRegexp( \
GetEventAttribute( { U 3 } ), \
{ S \".*monitorkeyid=(.*?) .*\" }, \
{ U 1 } \
) \
), \
{ U 145 }, \
GetRegexp( \
GetEventAttribute( { U 3 } ), \
{ S \".*severity=(.*)\" }, \
{ U 1 } \
) \
), \
{ U 144 }, \
GetRegexp( \
GetEventAttribute( { U 3 } ), \
{ S \"(.*?) monitor.*\" }, \
{ U 1 } \
) \
), \
{ U 143 }, \
GetRegexp( \
GetEventAttribute( { U 4 } ), \
{ S \".*\/(.*)\" }, \
{ U 1 } \
) \
) \
)"
________________________________
Från: Marty Davis [mailto:[email protected]]
Skickat: den 25 maj 2011 14:52
Till: spectrum
Ämne: [spectrum] Event Procedures CreateEventWithVariables multiple variables
This is my first attempt at Event Procedures so bear with me if I am not clear.
I have been trying to create an event procedure that extracts a string from an
event, parses out three sub-strings from it, and creates a event containing the
three sub-strings as variables {S 101}, {S 102}, and {S 103}.
I have tested the regex for all three successfully. I have no errors in the
event_disp_error_file. I get a new event 0xfff0000a created with only one
variable {S 101}.
It looks to me that the CreateEventWithVariables syntax may be incorrect (comma
delimited string).
I would be grateful for some help.
String from 0xfff00003: "2011-05-25 12:36:24 W3SVC1 NYCB-EXCHANGE04
10.26.128.89 POST /Microsoft-Server-ActiveSync
Cmd=Ping&User=nycb%5c28657&DeviceId=MotoA0000022C3DBA4&DeviceType=MOTOBLUR30
443 nycb\28657 75.225.53.49 HTTP/1.1 Moto-Blur/3.0 webmail.mynycb.com 401 1
1326 296 501 15 "
0xfff00003 P \
" CreateEventWithVariables ( \
{ C CURRENT_MODEL }, \
{ H 0xfff0000a }, \
SetEventVariable ( \
GetEventVariableList (), \
{ U 101 }, \
GetRegexp ( \
GetEventVariable( { U 17 } ), \
{ S \".*443 (.*?)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).* (HTTP.*?)
webmail\.mynycb\.com.*\" }, \
{ U 1 } \
) \
), \
SetEventVariable ( \
GetEventVariableList (), \
{ U 102 }, \
GetRegexp ( \
GetEventVariable( { U 17 } ), \
{ S \".*443 (.*?)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).* (HTTP.*?)
webmail\.mynycb\.com.*\" }, \
{ U 2 } \
) \
), \
SetEventVariable ( \
GetEventVariableList (), \
{ U 103 }, \
GetRegexp ( \
GetEventVariable( { U 17 } ), \
{ S \".*443 (.*?)([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).* (HTTP.*?)
webmail\.mynycb\.com.*\" }, \
{ U 3 } \
) \
) \
--
Marty Davis
* --To unsubscribe from spectrum, send email to [email protected] with the
body: unsubscribe spectrum [email protected]
---
To unsubscribe from spectrum, send email to [email protected] with the body:
unsubscribe spectrum [email protected]
