Issue extracting variable and passing the value to an Active List

[rony]

Hi all,

We were having a small issue related to Variables.

Please consider the below ofice entry sample log

" [lastname], [firstname]" was granted access....

Here we declared a variable to first get the last index value till "was granted". Then value of the name was derived as the substring from integer count 0 to value of the first variable. We decided to create an active list to contain the name of people who already entered.

Will it be possible to add this newly derived variable to an active list?

Also with regards to another log sample we needed to derive the first word from a log, such that the first space is the delimiter.

eg [value1] attempted to access server

     [value2] attempted to access server

Here we need to only extract value1 and value2 which are before the first space

Kindly provide possible suggestions

Thanks and Regards,

Rony

[Tobias1]

Rony,

You can put variables in active lists but only indirectly via regular fields:

1. action: set event field (i.e. flexString1 = yourVariable)
2. action: add to active list (here: flexString1)

Generally the parsing should be done on connector level (user names go into destinationUserName) and not with variables. If you want to do it anyway:

1. indexOf first space
2. substring starting from 1 to the index found in (1)

Hope that helps,

Tobias

[rony]

Hi Tobiaz,

Regarding the extracting variable issue, i was able to get it right. Had made 2 mistakes

1. did not assign flexstring1=$variablename , ie forgot $

2. did not add the variables in aggregation.

Regarding the second issue

pls consider the below logs

London users

London servers

Cambridge users

Cambridge servers

Here my need is to extract London and Cambridge if i could have the space after london/cambridge as my delimiter

Kindly let me know your suggestions

Rony

[Tobias1]

Did you try what I have suggested?

1. new variable: indexOf, <your field with the string>, String " " (without quotes)
2. new variable: substring <your field with the string>, start index: Integer 0, end index: <your variable from (1)>
   -> this variable should contain your location name

Is this what you were looking for?

Regards,

Tobias

[mmuessig]

Hi Tobias,

i tried that for another reason and it does not work.

I want to get the last position of a " " (blank) in a string with indexOf.

I created a variable, selected a base string field and typed a blank (just hitting space key once in the second argument field).

Before saving, i tested it with the calucate feature which gave me the feeling everything would work fine.

On acutal data my "indexOf Variable" was empty.

Obviously the problem is, that the blank in the string field gets stripped when saving the variable.

I was in the lucky position, that my seperator is acutally a [BLANK]-[BLANK]

So when using [BLANK]-[BLANK] as delimiter, the second blank gets stripped either way, but the remaining rest [BLANK]- is enough to get the function working...

Regards