Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
Highlighted
esbarro Absent Member.
Absent Member.
392 views

Trying to convert a list intersection result into a string?

Using ArcSight Console Version 6.8.0.2108.2

Problem:

I am using a rule to populate an active list. Using local variables I am trying to find the intersection between two lists and display that in the active list after converting it to a string.

Example:

1. I have two strings which the values within are separated by commas.

String1 = A,B,C,HOUSE,CAR,CAT

String2 = A,B,C,HOUSE

2. I then convert these strings to lists.

List1 = convert_string_to_list(String1, ,)

List2 = convert_string_to_list(String2, ,)

3. I then perform a list intersection on the two lists

ListIntersect = list_intersection(List1, List2)

4. Then convert the list intersection result list into a string

FinalString = convert_list_to_string(ListIntersect)

However, when I go to view the FinalString as a field in the active list, it is blank.

I tried doing a custom conditional evaluation to see whether or not the string returns null, but it continues to return FinalString:

Example of conditional evaluation used:

FinalString is "NULL"

If True = String "Is Null"

Else = Field FinalString

Returns: FinalString

I then tried putting in values in the 'preview' option within the local variable properties to see what output I was getting:

Example:

1. Converting strings to lists preview results in:

List1 = [A, B, C, HOUSE, CAR, CAT]

List2 = [A, B, C, HOUSE]

2. List intersection preview results in:

ListIntersect = [[A, B, C, HOUSE]

Converting list to a string has no preview and seems to be the cause of the problem. As you can see the preview of the ListIntersect adds another square bracket at the front of the list. I tried concatenating an extra square bracket on the end of the original two strings to see if it would make any difference [[A, B, C, HOUSE, ]] but FinalString was still blank.

I can't seem to figure out what is causing the FinalString to return blank. But I do believe there is something with the ListIntersect that is causing it to happen.

Labels (2)
0 Likes
2 Replies
Established Member.. raymond.doty
Established Member..

Re: Trying to convert a list intersection result into a string?

How are you getting the list field/variable populated (not the active list)?  Where are these variable created?  Is it on a rule - if so - did you add the fields to rule aggregation?  You are covering a pretty advanced/edge case.  If I get some time I might play with this, because its interesting

0 Likes
esbarro Absent Member.
Absent Member.

Re: Trying to convert a list intersection result into a string?

The rule is a lightweight rule. It first takes a string value from an event field:

Example of field in event:

userWords:a,b,c,house,car givenName:Bob userID:1234

Which contains multiple values. Within the same rule (which is also used to calculate the list intersection) the string is split up to create the different fields.

This is done using a velocity template in the local variables for each field to be made:

Example:

userWords =      #set( $x = $eventField.replaceAll(*.*?userWords:","") )

                            $x.replaceAll("givenName.*","")

givenName =      #set( $x = $eventField.replaceAll(".*?givenName:","") )

                            $x.replaceAll(" userID.*","")

(The velocity template part already existed/was created by another collegue, so I do not know how to create these myself)

Example result:

userWords                    givenName                    userID

a,b,c,d,house,car          Bob                                1234

From here String1 is the value of userWords and String2 is set values which won't change so this is created using a concat with a blank string.

String1 = userWords

String2 = concat(A,B,C,HOUSE, )

This then continues on to my original question/issue.

Hope this helps.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.