Highlighted
vincent.garramo Absent Member.
Absent Member.
1126 views

Matching a Local Variable to an Active List in a Rule

Hi Everyone:

I am trying to do some matching against an active list in a standard rule, but I seem to be missing something.

The list I have looks something like this: Columns: active_list_email_prefix, user_role Example: john.smith, administrator John Smith may have multiple email addresses, like john.smith@my.org and john.smith@my.old.org, which is why I'm matching on the prefix (local part) only.

So, for email fields in events of interest, I'm extracting the prefix with two local variables defined within a single rule (maybe it's better to do this with a velocity template?

atPosition = index_of(Destination User Name, @)

eventEmailPrefix = substring(Destination User Name,0,atPosition)

Then, in the same rule, I'm trying to match the active list rows with a get_activelist_value, which compares active_list_email_prefix with eventEmailPrefix.

Testing the comparison with a known eventEmailPrefix value in the local variable preview area works, but I don't get any matches when testing against actual events. If I assign eventEmailPrefix to a FlexString in an action, it *looks* correct in a test channel.

I'm aggregating on all of the Local Variables, just in case not aggregating could have caused a problem.  Can "over-aggregating" cause issues, too?

I have a similar rule working that compares the entire email address event field with another active list that stores the full email address, so I'm leaning toward the local variable assignments as the likely culprit.  Am I trying to do too much in a single rule?

Any thoughts or assistance would be greatly appreciated!

Thanks, VG

Labels (1)
0 Likes
2 Replies
rhope Acclaimed Contributor.
Acclaimed Contributor.

Re: Matching a Local Variable to an Active List in a Rule

This all looks correct and the extra aggregation shouldn't matter. Can you post some screenshots (one of each tab)?

0 Likes
vincent.garramo Absent Member.
Absent Member.

Re: Matching a Local Variable to an Active List in a Rule

Richard,

Thanks for replying.

When I went to get the screenshots, I thought I should double-check a few things, and think I found the issue (though I don't really understand it):

After the matching occurs, I was doing a conditional evaluation to replace NULL values in the list with my own text "Not In List".  I'm doing this with the other rule I mentioned and it works fine.

In this case, however, it seemed to think everything was NULL and was always returning "Not In List", which is why I thought the matching wasn't working.  When I bypassed the conditional and directly assigned the list values to a FlexString, I got the results I expected.

After playing around with the conditional a bit, I found that testing for NOT NULL works, but testing for NULL doesn't.

So this works:

arcsight-conditional-works.PNG

but this doesn't (always returns Not In List):

arcsight-conditional-notworks.PNG

Does that make any sense?  I must be missing something obvious.

Here are the Actions and Local Variable tabs, in case they help:

arcsight-mailmatch-actions.PNGarcsight-mailmatch-lv.PNG

Thank again!  I appreciate the help.

VG

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.