Substitution values for ECI configuration parameters lists the substitution values that can be used in ECI configuration parameters, such as User Defined values, Event Setup options, and Calculated values.

Table 1. Substitution values for ECI configuration parameters

Substitution Value

Description

$A$

The source text in the event.

$E$

The enterprise text in the event.

$N$

The ‘generic’ field in the event.

$S$

The ‘specific’ field in the event.

$T$

The timestamp in the event.

$SYS$

Given the source IP of the event, the node hosting the IP will be substituted.

$EVENTTEXT$

The current value of EventText.

$V1$ ----> $V20$

Replaced with the text value in the respective varbind.

$OID1$ ----> $OID20$

Replaced with the OID value in the respective varbind.

$UserDefined1$ ----> $UserDefined20$

Notification property that can be populated with any string.

$#$

Replaced with the number of varbinds in the event.

$*$

Replaced with text consisting of all varbind OIDs and values in the event.

$V*$

Replaced with text consisting of all varbind values in the event.

$Vx(n)c$

Varbind subfield extractor. If a varbind is itself a string with subfields that can be parsed with a character token, you can extract a particular subfield by using Vx(n)c, where:

  • x is the varbind number (x value represents a varbind 1–10).

  • n is the subfield desired (n value is a number specifying which of the subfields should be used in the substitution. Subfield numbering starts with 0).

  • c is the tokenizer character. The c value is a single character that can be used as a tokenizer to parse the varbind string. In many cases this is a comma.

Example: if $V1 is Tempe,AZ,85284 then $V1(2), would give AZ.

This can also be done with the extract function. The extract function takes three parameters: string, separator, and field.

Example: if $V1 is Tempe,AZ,85284 then extract( $V1, ",", 2) would give AZ.

$concat(string1, string2, ...)$

Will return the concatenation of two or more strings.

Example: $concat(a, b, c) would return abc.

$contains(textToSearch, textToLookFor)$

Will return true if textToLookFor exists in textToSearch string.

$endsWith(textToSearch, textToLookFor)$

Will return true if textToLookFor is at the end of textToSearch.

$extract(string, separator, field)$

Will split the string using the separator and returns the field.

Examples:

extract ( "1,2,3,4,5,6", "," ,4 ) ---> 4

extract ( "abcdef", "c", 2 ) ---> "def"

$getAttribute(className, instanceName, attributeName)$

Will return the value of the given attribute from the given class and instance.

$sizeOf(text)$

Will return the number of characters in text. Text can itself be a substitution, such as $V1$.

Example: $sizeOf(True) would produce 4.

$startsWith(textToSearch, textToLookFor)$

Will return true if textToLookFor is at the start of textToSearch.

$substr(text, pos, length)$

Will extract characters from text starting at position pos for the specified length. Text can itself be a substitution, such as $V1$.

Example: $substr(unknown,4,2) will produce no.

$time(format)$

Will produce a string based on the current time. The substitutions are as follows:

  • HH — 24 hour of day

  • MM — Minute of hour

  • SS — Second of minute

  • MTH — Month of year (numeric)

  • DD — Day of month

  • YY — Year

  • DOW — Day of week (3 char alphabetic)

The format characters take elements from the current time to create the text.

Examples: $time(DOW HH:MM) could produce the text Wed 22:04.

                 $time(HH:MM:SS) could produce 15:23:40.

$toLower(text)$

Will convert the characters in text to lower case. Text can itself be a substitution, such as $V1$.

Example: $toLower(TrUe) would produce true.

$toUpper(text) $

Will convert the characters in text to upper case. Text can itself be a substitution, such as $V1$.

Example: $toUpper(cat) would produce CAT.

$varbindCount$

Will return the number of varbinds.

$varbindKeyValue$

Will return a list of each varbind in "key: value" format, separated by commas.

$varbindValues$

Will return a list of varbind values, separated by commas.