mcsvtodde

The mcsvtodde command converts CSV data to enrichment data. This allows you to load CSV data into a cell as Dynamic Enrichment Match Table Data.

mcsvtodde syntax

mcsvtodde [-h|-?] [-z] [-q] [-v] [-c <ConfigFile>] {-p Var=<Value>} [-l <HomeLocation>] [-f <InputFile>] [-o <OutputFile>] [-r] [-a <Class>] -t <Tag> -m <MatchFieldCount> -e <OutputExpressionCount>

table1021 lists the command-specific options for mcsvtodde. For a list of common command options that apply to all CLI commands, see Event management common command options.

mcsvtodde options

Option	Description
`-a Class`	Generates match table data for reference Class (default: EVENT)
`-e OutputExpressionCount`	Specifies the number of output expression fields, OutputExpressionCount
`-f InputFile`	Retrieves input data from InputFile (default: standard input)
`-m MatchFieldCount`	Specifies the number of input match fields, MatchFieldCount
`-o OutputFile`	Writes converted commands into OutputFile (default: standard output)
`-r`	Replaces existing match table data (default: add to existing data)
`-t Tag`	Specifies match table tag as Tag The instance is associated with the match table that uses Tag. Each generated match table instance receives a name that is derived from the table tag by appending a time-dependent sequence number to ensure unique names.

Note

The mcsvtodde command reads the input file that contains CSV-formatted data. For each input line, the command produces a dynamic data enrichment match table instance command.
The first MatchFieldCount fields from the input line are converted to input match fields, in the same order. The following OutputExpressionCount fields from the input line are converted to output expressions, in the same order.
If the total number of fields in the input line is not the same as the sum of match fields and output expressions, the mcsvtodde command fails.

Input match field conversion applies the following rules:

Produced fields are atoms, quoted as needed.
An asterisk (*) at the beginning or at the end is treated as a wildcard and kept as is.
All literal input (that is non-wildcard) is encapsulated between (< >).Output expression field conversion applies the following rules:

Produced fields are atoms that, when evaluated as expressions, will yield atom values.
The sequence % is interpreted as a single literal %.
A sequence of the form %name% (not preceded by a ) is considered a reference to a slot.
A source field without references to slots is converted to a quoted atom.
A source field with references to slots, is converted to a sprintf function call.
Each slot reference is replaced with a %s.
Each reference to slot is added to the argument list of the sprintf function call as $1.slot.
If the table is requested to be completely replaced with new data, a specific command is produced as first command, to erase the table before adding the new data instances.

Replacing match table data example

To replace any existing match table data with new data (for the same table), specify the command similar to:

mcsvtodde -r -t enrich001 ...

The produced commands will start with:

ddelete DDEN_MATCH_TABLE; tag = enrich001; END

Static data example

This example refers to the sample data from the Contact.csv source file for the Service_Contact_Enrichment enrichment policy. This policy has four input match fields (mc_host_class, mc_host, mc_object_class, mc_object) and two output fields: (mc_service, mc_owner).

This example contains details of the command you must enter and the relevant output if the following line is included in the source file:

NT,server1,NT*,*,NC Web Order,Windows Support ext 4356

Input command

mcsvtodde -f Contact.csv -t enrich-tag_3 -m 4 -e 2

Output Command

dnew + DDEN_MATCH_TABLE;
	name = enrich-tag_3_4cf797f4_1;
	tag = enrich-tag_3;
	input_match = ['<NT>','<server1>','<NT>*','*'];
	ref_instances_classes = [EVENT];
	output_expressions = ['''NC Web Order''','''Windows Support ext 4356'''];
END

Variable data example

This example refers to the sample data from the TextTranslation.csv source file for the PATROL_Message_Translation enrichment policy. This policy has three input match fields: (mc_object_class, mc_parameter, p_class and one output field, msg).
This example contains details of the command you must enter and the relevant output if the following line is included in the source file:

SYBASE_AVAILABILITY,SuspectDatabases ,*,%mc_object%: %mc_parameter_value% suspect databases detected

Input command

mcsvtodde -f TextTranslation.csv -a PATROL_EV -t enrich-tag_4 -m 3 -e 1

Output command

dnew + DDEN_MATCH_TABLE;
	name = enrich-tag_4_4cf797f6_1;
	tag = enrich-tag_4;
	input_match = ['<SYBASE_AVAILABILITY>','<SuspectDatabases>','*'];
	ref_instances_classes = [PATROL_EV];
	output_expressions = ['sprintf("%s: %s suspect databases detected"
	,[$1.mc_object,$1.mc_parameter_value])'];
END

mcsvtodde return codes

There are no command-specific return codes for mcsvtodde. For a list of common return codes that apply to all CLI commands, see Event management return codes.