Ad Widget

Collapse

Can you use macro functions in trigger name?

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • cesarsj
    Senior Member
    • Dec 2018
    • 154

    #1

    Can you use macro functions in trigger name?

    I would like to capture the log:

    timestamp | date | machine | IPdest | username | IPfrom | action | service | protocol | ports | duration

    And be warned:

    {username} released the {service} through the IP machine {machine} on {date}

    Does the regsub function work on the trigger name?

  • gert.derouck
    Member
    • Jan 2020
    • 69

    #2
    Yes, you can use regsub in the trigger name.

    Comment

    • cesarsj
      Senior Member
      • Dec 2018
      • 154

      #3
      Originally posted by gert.derouck
      Yes, you can use regsub in the trigger name.
      I put the name like this:

      The user {{ITEM.VALUE}.regsub(^(?:[^|]*\|){4}([^|]*), \1)} did " {{ITEM.VALUE}.regsub(^(?:[^|]*\|){6}([^|]*), \1)}" the {{ITEM.VALUE}.regsub(^(?:[^|]*\|){7}([^|]*), \1)} service from the host with IP {{ITEM.VALUE}.regsub(^(?:[^|]*\|){3}([^|]*), \1)}

      And the output was:

      The user {timestamp | date | machine | IPdest | username | IPfrom | action | service | protocol | ports | duration
      .regsub(^(?:[^|]*\|){4}([^|]*), /1)}
      did " {timestamp | date | machine | IPdest | username | IPfrom | action | service | protocol | ports | duration
      .regsub(^(?:[^|]*\|){6}([^|]*), /1)}"
      the {timestamp | date | machine | IPdest | username | IPfrom | action | service | protocol | ports | duration
      .regsub(^(?:[^|]*\|){7}([^|]*), /1)}
      service from the host with IP {timestamp | date | machine | IPdest | username | IPfrom | action | service | protocol | ports | duration
      .regsub(^(?:[^|]*\|){3}([^|]*), /1)}

      That is, it did not work.

      Comment

      • gert.derouck
        Member
        • Jan 2020
        • 69

        #4
        Try using double quotes... Twice:
        {{ITEM.VALUE}.regsub("^(?:[^|]*\|){4}([^|]*)", "\1")}

        Comment

        • cesarsj
          Senior Member
          • Dec 2018
          • 154

          #5
          Originally posted by gert.derouck
          Try using double quotes... Twice:
          {{ITEM.VALUE}.regsub("^(?:[^|]*\|){4}([^|]*)", "\1")}
          So it worked! Thank you!

          Comment

          Working...