Return functions

Return functions are also known as non-void functions and return a value. Return functions are further classified into the following categories:

String functions
List functions
Number functions

For functions that have arguments of the String type, in the argument value, you can add a line break to move content to a new line by using the <br> tag. You can also use the <br> tag as a separator to separate text strings.

For an Enrich action, the functions list displays function based on the data type of the slot that you enrich as shown:

Data type of slots	Return functions available
String	Displays functions that return either a String, Number, or Boolean value.
List of string	Displays functions that return a List of string value.
Number	Displays functions that return a Number value.

For an Enrich or Variable action, the function parameters display slots and global variables based on the data type of the function parameter as shown:

Data type of parameters	Slots available
String	Displays slots and global variables that have either the String, Number, or Boolean data types.
List of string	Displays slots and global variables that have the List of String data type.
Number	Displays slots and global variables that have the Number data type.

Tip

In the following functions, in the Text String field, you can do one of the following:

Specify raw text
Select a slot
Select an already defined variable.
The variable needs to be already defined in the policy workflow, before the action under which you are adding the function.

String functions

These functions are used for string manipulation operations such as concatenating strings, replacing strings, and so on. These functions use slots or variables with a string value.

Concat

Concatenates two text strings to return a new string.

Input

Expected output

Example

Input 1= CPU utilization

Input 2=[CPU utilization,CPU utilization for the host is rapidly increasing,CPU utilization is growing]

Output=CPU utilization[CPU utilization,CPU utilization for the host is rapidly increasing,CPU utilization is growing]

ConcatList

Concatenates a list of comma-separated strings using the given separator and returns a new string.

Input

Expected output

Example

Input 1= [tagName1,tagName2,tagName3]

Input 2= -

Output=tagName1-tagName2-tagName3

Contains

Detects whether a text string contains a substring.

Input

Expected output

Example

Input 1=v1v4v5v6

Input 2=v4

Output=true

CurrentFormattedTimeStamp

Returns the current timestamp with the date in the specified date format and the time zone in UTC. Use this function to enrich slots that have the string data type.

Important

Make sure that you enrich slots that have String as the data type because the function returns a formatted text value for the current timestamp.

Input

Expected output

Example

Input =EEE, MMM d, “yy

Output=Wed, Dec 29, '21

To read a use case for this function, see Example-Retrieve-the-timestamp-as-a-date-format.

GetPosition

Returns the position of the first character of the first occurred substring, reading left to right.

Input

Expected output

Example

Input 1=GetPosition v3 cool

Input 2=cool

Output=16

GetPositionOnOccurrences

If the substring occurred for the given number of times, this function returns the position of the first character of the final substring based on the number of occurrences specified, reading left to right.

Input

Expected output

Example

Input 1=city reno is called reno

Input 2=reno

Input 3=2

Output=21

IsActiveTimeFrame

Returns the status of the time frame based on whether it is currently active. You can perform conditional event enrichment based on the status of the time frame.

Input

Expected output

To read a use case for this function, see Example-Assign-event-owner-according-to-the-time-frame-status.

MatchRegex

Matches a text string with a simple regular expression.

Input

Expected output

Example

Input 1=aaabbb

Input 2=a*b*

Output=true

Replace

Replaces part of a text string with another string.

Input

Expected output

Example

Input 1= CPU Utilization

Input 2=CPU

Input 3=Memory

Output=Memory Utilization

Split

Splits a text string into a list of substrings based on the separator occurring in the string.

Input

Expected output

Example

Input 1= CPU Utilization

Input 2=" "

Output=[CPU, Utilization]

StringLength

Returns the number of characters in a text string.

Input

Expected output

Example

Input 1=CPU Utilization

Output= 15

StringMatch

Matches character patterns in a text string and extracts fields from it. The pattern can contain literal text and substitutes.

Input

Expected output

Example

Input 1=CPU Utilization is 80

Input 2=CPU Utilization %s %d

Output=[is,80]

StringToInteger

Converts a text string that represents a number to an integer value.

Input

Expected output

Example

Input 1=20

Output=20

StringToReal

Converts a text string that represents a real number to a real number.

Input

Expected output

Example

Input 1=10.2

Output=10.2

Strip

Removes leading and trailing blank spaces from a text string.

Input

Expected output

Example

Input 1=" space " (provided without the double quotes)

Output=space

Substring

Returns part of a text string based on the given starting position and length.

Input

Expected output

Example

Input 1=CPU Utilization is increasing

Input 2=1

Input 3=15

Output=CPU Utilization

SubstringOnPositions

Returns part of a text string between the start and end positions.

Input

Expected output

Example

Input 1= CPU Utilization is increasing

Input 2=5

Input 3=16

Output=Utilization (includes the space character at the end)

SubstringOnStartPosition

Returns part of a text string starting from the given start position to the end of the string.

Input

Expected output

Example

Input 1= CPU Utilization

Input 2=5

Output=Utilization

ToBase64

Converts a text string to a Base64 value.

Input

Expected output

To read a use case for this function, see Example-Enrich-event-details-with-the-encoded-event-ID.

ToFormattedTimeStamp

Converts the timestamp from an epoch value to a string value in the specified date format.

Input

Expected output

Example

Input 1= yyyy-MM-dd h:mm a

Input 2= Occurred (Timestamp in milliseconds: 1681816440000)

Input 3= (GMT+05:30)Chennai, Kolkata, Mumbai, New Delhi

Output= 2023-04-18 4:44 PM

ToLowerCase

Converts all letters in a text string to lower case.

Input

Expected output

Example

Input 1=CPU Utilization

Output=cpu utilization

ToUpperCase

Converts all letters in a text string to upper case.

Input

Expected output

Example

Input 1=CPU Utilization

Output=CPU UTILIZATION

List functions

These functions are used for list manipulation operations such as determining the list length, retrieving an element from the list, and so on. These functions use slots or variables with string values. You can specify a list by using one of the following formats:

[listValue1,listValue2,listValue3]
["listValue1","listValue2","listValue3"]

Important

[] is considered as an empty list.
Enclose list values that contain blank spaces or other special characters in double quotation marks.

ConcatListToList

Concatenates two lists of comma-separated strings to return a new list.

Input

Expected output

Example 1

Input 1=[abc,def,ghi]

Input 2=[123,456,789]

Output=[abc,def,ghi,123,456,789]

Example 2

Input 1=[CPU utilization is increasing,CPU utilization is growing,CPU utilization is rising]

Input 2=[$NEW.location]

Output=[CPU utilization is increasing,CPU utilization is growing,CPU utilization is rising,Houston] (Assuming that the location slot is the event has the value "Houston")

GetNote

Returns a note present in the given position in a list of notes in the incoming event. A note is a list of strings that contain information like the timestamp, owner, and the note content.

Input

Expected output

Example

An incoming event has the following list of notes:

[0x17cbca212fd,admin,BASIC_ENRICHMENT,0x17cbca212fd,admin,ADVANCED_ENRICHMENT,0x17cbca212fd,admin,NOTIFICATION]

Input= 2

Output= [0x17cbca212fd,admin,ADVANCED_ENRICHMENT]

To read a use case for this function, see Example-Retrieve-and-modify-notes-in-incoming-events.

IsDisjoint

Compares elements of two lists to verify that no common elements exist between them.

Input

Expected output

Example

Example 1:

Input 1=[123,111Input1,def,ghi]
Input 2=[456,789,abc]
Output=true (because no common elements are present in the two lists)

Example 2:

Input 1=[123,111,456]
Input 2=[456,789]
Output=true (because common elements are present in the two lists)

ListContains

Detects whether a list contains an element.

Input

Expected output

Example

Input 1=[v1,v2,v3,v4,v5,v6,v3,v2]

Input 2=v1

Output=true

ListGetElement

Returns the element present in the given position in a list, reading left to right.

Input

Expected output

Example

Input 1=[oxford,cambridge,london]

Input 2=2

Output=cambridge

ListIntersect

Compares two lists to return the common elements between them.

Input

Expected output

Example

Input 1=[html,css,javascript]

Input 2=css

Output=css

ListLength

Returns the number of elements in a list.

Input

Expected output

Example

Input 1=[html,css,javascript]

Output=3

ListUnion

Returns a union of all unique values between the two lists.

Duplicate values between the two lists are repeated only once. Duplicate values within a single list are retained.

Input

Expected output

Example

Input 1=[bmc,ade]

Input 2=[bmc,helix]

Output=[bmc,ade,helix]

RemoveDuplicateElements

Removes duplicate elements from a list.

Input

Expected output

Example

Input 1=[v1,v2,v3,v4,v5,v6,v3,v2]

Output=[v1,v2,v3,v4,v5,v6]

RemoveElement

Removes all occurrences of an element from a list.

Input

Expected output

Example

Input 1=[abc,def,ghi,jkl,mnp]

Input 2=def

Output=[abc,ghi,jkl,mnp]

RemoveElementList

Removes a list of elements from a list.

Input

Expected output

Example

Input 1=[v1,v2,v3,v4,v5,v6]

Input 2=[v2,v3]

Output=[v1,v4,v5,v6]

Number functions

These functions are used for integer manipulation operations such as integer addition, subtraction, and so on.

CurrentTimeStamp

Returns the current timestamp in epoch (milliseconds). This function does not require any input parameter. Use this function to enrich slots having the number data type.

Important

Make sure that you enrich slots that have Number as the data type because the function returns the current timestamp value in milliseconds.

Expected output

For example, if the current data and time is Wednesday, December 29, 2021 12:03:42 PM GMT+05:30, then the function returns the timestamp as 1640759622000 milliseconds.

To read a use case for this function, see Example-Check-whether-there-is-a-time-delay-between-events.

Math

Performs basic mathematical operations on two numbers and returns the result.

Input

Expected output

Example

Input 1=+

Input 2=5

Input 3=7

Output=12