Example: Manage ASCII characters in the event data

Scenario

Sarah is an administrator at Apex Global. She wants more flexibility for managing characters in the event data. To achieve this goal, she plans to enrich record separator ASCII characters in the event data with other characters in advanced enrichment policies. This enrichment helps her add more meaningful information to events, and process them effectively.

Can Sarah achieve this goal?

Yes! Sarah can use the Char function in advanced enrichment policies.

To enrich the detailed message event slot, perform the following steps:

  1. Define the event selection criteria.
  2. Build the policy workflow.

Actions used in the example

  • Variable
  • Enrich

For more information about actions, see Actions-for-advanced-and-time-based-enrichment.

To define the event selection criteria

  1. Select Configuration > Event Policies and click Create.
  2. In Event Selection Criteria, define a condition to select events that contain the message charfunction.

The following image illustrates how the event selection criteria will look:

Char function ESC.png

To learn how to construct the event selection criteria, see Creating-and-enabling-event-policies.

To build the policy workflow

On the Advanced Enrichment page, perform the following steps:
Failed to execute the [excerpt-include] macro. Cause: [Error number 2 in 0: No wiki with id [confluencePage:page] could be found]. Click on this message for details.

  1. Add the Variable action to store the value of the record separator ASCII character and in the Value field of the variable settings, click Function; select the Char function and specify a number to convert into a character; store the function output in the $Record_Separator variable and click Apply. 
    Record separator variable.png

  2. Add an Enrich action to enrich the event location and in the Value field of the enrichment settings, click Function; select the Replace function to replace occurrences of the record separator ASCII character in the Model Name slot with a hyphen (-) and click Apply.Enrich event location.png
  3. Add an Enrich action to enrich the event tag and in the Value field of the enrichment settings, click Function; select the Split function to split the Model Name slot value by the record separator ASCII character, click Apply, and then save the advanced enrichment policy configuration.Enrich event tag.png

Results

The preceding policy workflow enriches the value of the event location and tags on the Event Details page.

Without event enrichment

Location before event enrichment.png

Tags before event enrichment.png

With event enrichment

Location after event enrichment.png

Tags after event enrichment.png

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*