Writing Connector Policy › Connector Policy Overview › Property Functions

Property Functions

In connector policy operations, various functions help transform or generate event properties such as date, time, and server name.

Use any functions in the function library for connector policy to convert tags to a specific output. Write these functions enclosed in curly brackets {} as part of the input attribute in a Field element.

You can use these functions in the input attribute of any operation. For example:

<Format>
<Field  output=’’ format=’{0}’ input=’{somefunction(param1)}’ />
</Format>

Functions with no parameters use the following syntax:

{function}

Functions with additional parameters use a different syntax as follows:

{function([param1,param2,param3])}

Examples of the functions that CA SOI includes are as follows:

• Host
  • {localhost}—Returns the local hostname (fully qualified)
  • {ip(propname)}— Dereferences the property (usually a host name) and converts to an IPV4 address
  • {fqdn(propname)}—Dereferences the property (usually an IPV4 address) and converts to a fully qualified domain name
  • {convertHexToMac([propname,-])}—Dereferences the property (a hexadecimal code for a MAC address) and converts to a delimited string using the second parameter delimiter character
• DateTime
  • {xsdateTime(now)}—Returns a datetime stamp formatted in xs:dateTime ( yyyy-mm-ddThh:mm:ss-zz:zz)
  • {xsdateTime(propname)}—Dereferences the property (epoch time in seconds or milliseconds) and converts to xs:dateTime format
  • {convertxsdateTime([propname,MMM d yyyy K:mm:ss a])}—Dereferences the property (a datetime formatted string), parses the property according to the second parameter, and converts to xs:dateTime
  • {datetime()}—Generates a date and time string for the current date and time and results in the following output structure: March 12, 2008 1:31:00PM
  • {datetime(propname)}—Generates a date and time string for the date and time represented by an event property value, where the property is a long integer representing some number of seconds since January 1, 1970
  • {timet()}—Generates a long integer representing the current number of seconds since January 1, 1970
  • {timet(propname)}—Generates a long integer representing the number of seconds since January 1, 1970, using the event property value, which must be a date and time string
• Date
  • {xsDate(now)}—Returns a date stamp formatted in xs:date ( yyyy-mm-dd-zz:zz)
  • {xsDate(propname)}—Dereferences the property (epoch time in seconds or milliseconds) and converts to xs:date format
  • {convertxsDate([propname,MMM d yyyy K:mm:ss a])}—Dereferences the property (a date time formatted string), parses the property according to the second parameter, and converts to xs:date
• Time
  • {xsTime(now)}—Returns a time stamp formatted in xs:time ( hh:mm:ss-zz:zz)
  • {xsTime(propname)}—Dereferences the property (epoch time in seconds or milliseconds) and converts to xs:time format
  • {convertxsTime([propname,MMM d yyyy K:mm:ss a])}—Dereferences the property (a date time formatted string), parses it according to the 2nd parameter, and converts to xs:time
• Array
  • {entry(propname)}—References an entry in an array and returns the first property value in a list. Functions are available for entry1 and entry2 to reference values at different places in an array
• String
  • {replace([propname,ch1,ch2])}—Replaces any character or string in a specified property with another character
    • propname—Specifies the property to search for a character or string to replace
    • ch1—Specifies a character or string to search for and replace in the specified property
    • ch2—Specifies a replacement character or string
  • {toLower(propname)}—Converts uppercase characters in the specified property to lowercase
  • {toUpper(propname)}—Converts lowercase characters in the specified property to uppercase
• Other
  • {uniqueidentifier}—Generates a SQL unique identifier, such as 61CD55D1-F142-2E04-8A2A-9667118CF65E
  • {prepareconsolidatefield}—Parses combinations of event fields entered in consolidation operations