1 Macro functions

Macro functions offer the ability to customize macro values (for example, shorten or extract specific substrings), making them easier to work with.

All functions listed here are supported with all types of macros:

• Built-in macros
• User macros
• Low-level discovery macros
• Expression macros

Macro functions can be used in all locations supporting the listed macros. This applies unless explicitly stated that only a macro is expected (for example, when configuring host macros or low-level discovery rule filters).

The functions are listed without additional information. Click on the function to see the full details.

Function details

The syntax of a macro function is:

{macro.func(params)}

• macro - the macro to customize, for example {ITEM.VALUE} or {#LLDMACRO};
• func - the function to apply;
• params - a comma-delimited list of function parameters, which must be quoted if:
  • start with a space or double quotes;
  • contain closing parentheses "``" or a comma.

Optional function parameters are indicated by < >.

fmtnum(digits)

Number formatting to control the number of digits printed after the decimal point.

Parameters:

• digits - the number of digits after decimal point. Valid range: 0-20. No trailing zeros will be produced.

Examples:

fmttime(format,<time_shift>)

Time formatting.
Note that this function can be used with macros that resolve to a value in one of the following time formats:

• hh:mm:ss
• yyyy-mm-ddThh:mm:ss[tz] (ISO8601 standard)
• unix timestamp

Parameters:

• format - mandatory format string, compatible with strftime function formatting;
  
• time_shift (optional) - the time shift applied to the time before formatting; should start with -<N><time_unit> or +<N><time_unit>, where:
  
  • N - the number of time units to add or subtract;
  • time_unit - h (hour), d (day), w (week), M (month) or y (year).

Comments:

• The time_shift parameter supports multistep time operations and may include /<time_unit> for shifting to the beginning of the time unit (/d - midnight, /w - 1st day of the week (Monday), /M - 1st day of the month, etc.). Examples: -1w - exactly 7 days back; -1w/w - Monday of the previous week; -1w/w+1d - Tuesday of the previous week.
• Time operations are calculated from left to right without priorities. For example, -1M/d+1h/w will be parsed as ((-1M/d)+1h)/w.

Examples:

iregsub(pattern,output)

Substring extraction by a regular expression match (case-insensitive).

Parameters:

• pattern - the regular expression to match;
• output - the output options. \1 - \9 placeholders are supported to capture groups. \0 returns the matched text.

Comments:

• If the function pattern is an incorrect regular expression, then the macro evaluates to 'UNKNOWN' (except for low-level discovery macros, in which case the function will be ignored, and the macro will remain unresolved).

regsub(pattern,output)

Substring extraction by a regular expression match (case-sensitive).

Parameters:

• pattern - the regular expression to match;
• output - the output options. \1 - \9 placeholders are supported to capture groups. \0 returns the matched text.

Comments:

• If the function pattern is an incorrect regular expression, then the macro evaluates to 'UNKNOWN' (except for low-level discovery macros, in which case the function will be ignored, and the macro will remain unresolved).

Examples: