Example: Manage ASCII characters in the event data

To enrich the detailed message event slot, perform the following steps:

1. Define the event selection criteria.
2. Build the policy workflow.

Actions used in the example

• Variable
• Enrich

For more information about actions, see Actions-for-advanced-and-time-based-enrichment.

To define the event selection criteria

1. Select Configuration > Event Policies and click Create.
2. In Event Selection Criteria, define a condition to select events that contain the message charfunction.

The following image illustrates how the event selection criteria will look:

To learn how to construct the event selection criteria, see Creating-and-enabling-event-policies.

To build the policy workflow

On the Advanced Enrichment page, perform the following steps:
Failed to execute the [excerpt-include] macro.

1. Add the Variable action to store the value of the record separator ASCII character and in the Value field of the variable settings, click Function; select the Char function and specify a number to convert into a character; store the function output in the $Record_Separator variable and click Apply. 
   
   
   
2. Add an Enrich action to enrich the event location and in the Value field of the enrichment settings, click Function; select the Replace function to replace occurrences of the record separator ASCII character in the Model Name slot with a hyphen (-) and click Apply.
3. Add an Enrich action to enrich the event tag and in the Value field of the enrichment settings, click Function; select the Split function to split the Model Name slot value by the record separator ASCII character, click Apply, and then save the advanced enrichment policy configuration.

Results

The preceding policy workflow enriches the value of the event location and tags on the Event Details page.

Without event enrichment

With event enrichment