Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
Highlighted
Frequent Contributor.. jcamba Frequent Contributor..
Frequent Contributor..
385 views

Accessing List Elements via Velocity

I'm trying to take a "list" in ArcSight and access only certain elements through Velocity.

Example Local Variables

stringVar = evaluate_velocity_template("Item1, Item2,Item3")
listVar = convert_string_to_list(stringVar)
getElementVar = evaluate_velocity_template($listVar.get[0])

When outputting "getElementVar" you'd see the following.

"Item1, Item2,Item3"[0]


Note that this only occurs when I use a "List" Local Variable. If I create my own "List" in Velocity, like so....

#set ($newList = [ "Element1", "Element2", "Element3" ])
$newList.get(0)

The output is correctly seen as the following.

Element1


When I use "getClass().getName()' on the List Local Variable, Arcsight outputs "java.lang.String." However, when using this same call on a List created within Velocity, I get an actual "java.util.ArrayList". 

Does anyone have any suggestions on how I would go about converting the "Local Variable List" into an actual Java List? Or, does anyone have any suggestions on how I might accomplish my goal otherwise?

0 Likes
3 Replies
Micro Focus Expert
Micro Focus Expert

Re: Accessing List Elements via Velocity

What is your "convert_string_to_list" function? Do you split it?

An example i could find:

#set ($string = "ABCD/GIST/SPIT") #set ($output = $string.split('/')) $output[0] $output[1] $output[2]

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
0 Likes
Frequent Contributor.. jcamba Frequent Contributor..
Frequent Contributor..

Re: Accessing List Elements via Velocity

To answer your immediate question, "convert_string_to_list" is just the way ArcSight describes the Local Variable in the Rule Inspect/Edit panel. This isn't something that I have control over; this is a Local Variable function found under "Type Conversion".
rulelist.PNG


Regarding the suggested Velocity....

#set ($string = "ABCD/GIST/SPIT") #set ($output = $string.split('/')) $output[0] $output[1] $output[2]


This is an example I had founder earlier as well; it does not seem to work anywhere in ArcSight. See the following output.

 [Ljava.lang.String;@18c0d65[0] [Ljava.lang.String;@18c0d65[1] [Ljava.lang.String;@18c0d65[2]

using .get(intIndex) doesn't seem to work either.

I did get SOMETHING working; however, it only works within the "Custom Columns" in an Active Channel and throws a "Null Pointer Error" in a Rule. This is pretty much useless to me.

#set ($aString = "ABCD/GIST/SPIT") 
#set ($someOut = $aString.split('/')) 
#foreach ($itemz in $someOut) 
$velocityCount$itemz 
#end


Any other ideas? I really wish we could get one of the actual ArcSight Devs in here, as I think this is primarily a Type-handling issue.

0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Accessing List Elements via Velocity

Unfortunately my idea is to always stay away from Velocity Templates in ArcSight, currently not found something i could not implement in another manner, especially since Velocity is so heavy on ArcSight operations.

The documentation of Velocity is quite poor, and the implementation strays away from the language as well, so i wish i could give you a better answer. Hopefully someone else that also does Velocity will see this post soon enough!

If not i will have a go at it tomorrow so i can properly recreate what you are doing and find a solution :)

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.