Support Centre

Find articles, help and advice.

 
Welcome, Guest Login

Support Center

iiAgent - Wild Carding Problems

Last Updated: Jul 23, 2015 09:49AM UTC

Problem

Using the rule below is not matching things correctly with FreeText being populated

ET assetmgmt/transaction7 | 1403178486974 | 1403178488941 | 192.168.11.10 | Asset Management - assetmgmt | 192.168.9.229 | 88 |
Rule: AssetMgmt_Rule
%s* | %s* | %s* |
hostname DEFAULT
OriginDateTime DEFAULT
Origin DEFAULT
source AssetMgmt
OriginEvtClass AssetMgmt
FreeText $1
END

Solution

Beware pattern matching special characters, of which the '|' symbol is one. When you want to match the actual character you need to disable the special processing by escaping it with a '\' character. Thus the pattern should be:

%s* \| %s* \| %s* \|

Notes

See Special Characters under: http://www.regular-expressions.info/characters.html

Contact Us

desk.com@interlinksoftware.com
https://cdn.desk.com/
false
desk
Loading
seconds ago
a minute ago
minutes ago
an hour ago
hours ago
a day ago
days ago
about
false
Invalid characters found
/customer/en/portal/articles/autocomplete