Highlighted
Larry Super Contributor.
Super Contributor.
750 views

Agent.Properties Question

We are using the agent properties to import the filePath, sourceHostName, and fileName based on the regex,  (/.*?/.*?/(.*?)/)(\w+.log).  The string bing parsed looks similar to /opt/mnt/TESTServerName/file1.log and parses as follows:

filePath = /opt/mnt/TESTServerName/

sourceHostName = TESTServerName

fileName = file1.log

The Question we have, how can you add a string constant to the information to be included into the sourceHostName variable?  Such that you add say ".test.com" - giving you "TESTServerName.test.com" as the contents of the sourceHostName variable being sent up stream to ArcSight ESM.   We have discovered that not all of the entries will properly give the IP Address, etc. without having the fully qualified name available. 

Has anyone done anything similar and can you provide guidance.

Thanks

Labels (3)
0 Likes
Reply
2 Replies
Micro Focus Expert
Micro Focus Expert

Re: Agent.Properties Question

I think you could use the concatenate operator as

event.sourceHostName=__concatenate(TESTServerName,".test.com")

0 Likes
Reply
Larry Super Contributor.
Super Contributor.

Re: Agent.Properties Question

I have used similar in the parser's property file.  However, I am not sure how this could be used in the agent[x].extractfieldnames= parameter in the agent.properties files of a connector.

Apologies - looking back at the original post - it is not as clear as I had hoped.  We are using the Agent.Properties files parameters:

agents[x].usefieldextractor= true
agents[x].extractsource=File Path
agents[x].extractfieldnames =filePath,sourceHostName,fileName
agents[x].extractregex= (/.*?/.*?/(.*?)/)(\w+.log)
0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.