Previous Topic: Internal TokensNext Topic: Global Constants


User-Defined Tokens

User-defined tokens can be included in any field of an incoming matching message. User-defined tokens are defined as &(..), with the name of the user-defined token in the parentheses.

User-defined tokens can be used to establish a relationship among messages that should be correlated. For example, if you want to relate a ping failure on one server to a service failure on that particular server, you can define a token such as &(NODENAME) in the matching string of the two messages.

An assigned token, such as &(NODENAME), parsed from an incoming message, can be reused in an output message. For example, if you enter &(NODENAME) in the node field of a pipeline item match message, it is assigned to the first matching message and may be reused as part of an output message, such as a local correlation message.

User-defined tokens can facilitate template rules, that is, a new rule will be triggered for each unique user-defined token assignment. For more information, see Template Rules.

The user-defined token value is assigned by the first matching message, and it does not change until the rule has been reset.