Previous Topic: Set Direct MappingsNext Topic: Set Concat Function Mapping


Set Function Mappings

Function mappings link a CEG field to a value using a function to retrieve or define the refined event information that appears in the refined event. All function mappings consist of a CEG field name, a predefined or class field value, and the function.

For example, a function mapping can concatenate a series of native event values to a single CEG field using the concat function.

If there are duplicate function mappings, the DM file uses the last one it finds. You could set a duplicate mapping to call a second function if the first was not found or did not function as expected.

To set function mappings

  1. Open the mapping file wizard, enter a name and select a Logname for the mapping file, and advance to the Function Mappings step.

    The Function Mappings screen appears, displaying current or default mappings. The Name column shows a CEG or parsed field, the Function column the current linking function, and the Value column a text or field value.

    Note: Select a parsing file in the Provide File Details step for parsed field values to appear.

  2. Click Add Function Mapping to add a new mapping entry, or select a current mapping to edit.

    The mapping entry appears in the Mapping Details pane.

  3. Select a CEG field to map to from the Field drop-down menu. When you begin typing, the auto-complete feature narrows the list of available CEG fields.
  4. Select a function to use for the mapping from the Function drop down menu.

    Note: The concatenate (concat) function works differently than the others, because you specify multiple target values. For more information, see Set a Concat Function Mapping.

  5. Enter a target value for the mapping in the Add Value entry field and click the Add Value button next to it. You can precede the value with "$" to denote a field value rather than a specific value.

    The value appears in the Selected Fields area.

  6. (Optional) You can enter multiple mappings for a single field, using the up and down arrows to set the order in which the DM file considers them.

    Note: Adding multiple values decreases performance of the mapping, so use stand-alone function mappings only if necessary.

  7. (Optional) Use the shuttle control to move unneeded values to the Available Fields area to prevent them from being considered for the current mapping.
  8. When you have added all the function mappings you want, click the appropriate arrow to advance to the wizard step you want to complete next, or click Save and Close.

    If you click Save and Close, the new file appears in the Mapping File User folder, otherwise the step you select appears.