Get specifications returns the address and length of a field value. Some Get specifications, especially the triplet type specifications, return multiple instances of a field, if appropriate, for instance, if the triplet indicates multiple repetitions. For some Format specifications, such as FInt, ignore the length returned by the Get specification. Some Format specifications, such as FChar, typically specify their own maximum length.
| |
|---|
GApf(GetDSNSpec(...) [GetVolserSpec(...)])
| Returns the address of a one-byte field that contains x'80', if the named data set is APF-authorized else X'00' See Duplicate data set names and false positives and Other limitations for a discussion of the limitations of APF status enrichment. You would usually use GApf with FBool, as in the following example: DEF SMF14JFCBDSNM_APF APF SMF_T14() FBool(UChar 0x80) + GApf(GBase(68 44))
| Location in the record of the data set name Specify any valid Get specification except GNull. The data must either be 44 or more bytes in length, left-justified and blank-padded, or GetDSNSpec must be able to return the exact data set name length. This operand is required. |
|---|
GetVolserSpec(...) | Location in the record of the volume serial Specify any valid Get specification except GNull. The data is assumed to be six bytes in length. This operand is optional. If you omit GetVolserSpec, then GApf returns x'80' if any APF-authorized data set with a matching name is found. |
|---|
|
GArray(count_format GetCountSpec(...) GetFirstElementSpec(...) displacement length)
| Returns the address of a field in each element of an array The array elements are assumed to be of fixed-length. | Format of the count of elements in the array Specify any of the integer types from the Integer types table except UCharUChar and UNiblUNibl. (For GConst code LongLong.) This operand is required. |
|---|
| Location in the record of the count of elements Specify any valid Get specification except GNull (including GConst if appropriate). This operand is required. |
|---|
| Location in the record of the first element of the array Specify any valid Get specification except GNull. This operand is required. |
|---|
| Displacement of the field in each array element relative to zero. This operand is required. |
|---|
| Length of each element of the array Specify a positive integer between 1–32767. This operand is required. |
|---|
|
GBase(displacement [length])
| Returns the address and length of a value in the base of the Event record | Displacement of the value relative to zero and including the record control word (llbb) Offset 5, for instance, is the SMF record type field. This is the offset usually given in SMF record documentation and assembly listings. This operand is required. |
|---|
| Length of the value This operand is optional. If you omit length, it defaults to the length of the remainder of the record beyond the displacement specified. |
|---|
|
GCICSmonData(class displacement length)
| Returns the address and length of fields referenced by an offset into a Performance, Exception or Resource data record of a CICS Monitor Subtype 1 data record | PERFormance, EXCEPT or RESource, indicating the type of data record Do not use PERFormance; instead use the GCICSmonPerf specification. |
|---|
| Displacement, base zero, of the field in the data record This operand is required. |
|---|
| Length of the value This operand is required. |
|---|
|
GCICSmonPerf([fieldname] [offset])
| Returns the address and length of a CICS Monitoring Performance field | IBM name of a performance field This operand is optional. If omitted, it defaults to the name of the BMC AMI Defender field (the name specified in DEF fieldname … GCICSmonPerf()). |
|---|
| Offset in the range, -32767 to +32767, of the data relative to the named field This operand is optional. If omitted, it defaults to zero. |
|---|
|
GCICSmonTriplet(offset_of_triplet displacement length)
| Returns the address and length of fields in a section pointed to by a CICS performance data record triplet SMF triplets are documented in the IBM documentation about SMF. GCICSmonTriplet should only be used for the Transaction Resource ID triplet and not for triplets with a repetition count other than one (or zero). | Offset of the pointer triplet in the current performance data record This operand is required. |
|---|
| Displacement, base zero, of the field in the section This operand is required. |
|---|
| Length of the value This operand is required. |
|---|
|
GCICSresSect(class displacement length)
| Returns the address and length of fields referenced by an offset into a File, TSQueue, or DPL section of a CICS Monitor Resource (Class 5) data record | FILE, TSQueue, or DPL, indicating the type of section |
|---|
| Displacement, base zero, of the field in the section This operand is required |
|---|
| Length of the value This operand is required. |
|---|
|
GCompute(FormatLeft GetLeft(…) Operation FormatRight GetRight(…))
| Returns the address and length of a signed 64-bit integer computed as specified | Format of the left-hand operand Specify any of the integer types from the Integer types table except UCharUChar and UNiblUNibl. (For the result of GConst or GCompute code LongLong.) This operand is required. |
|---|
| Location of the left-hand operand Specify any valid Get specification except GNull. This operand is required. |
|---|
| Arithmetic operation to be performed. For instance, specifies that the right-hand operand is to be subtracted from the left-hand operand Specify any of the operators from the Arithmetic operator types table. |
|---|
| Format of the right-hand operand. Specify any of the integer types from the Integer types table except UCharUChar and UNiblUNibl For the result of GConst or GCompute code LongLong.) This operand is required. |
|---|
| Location of the right-hand operand Specify any valid Get specification except GNull. This operand is required. |
|---|
|
GConf(ind_number displacement) | Returns the address and length of data in a configuration record section The specification processes all the sections of the record with the given section identification number. | Section identification number The number is indicated in SMF22ETY for ACTIVATE command record(SMF22IND=09) and at displacement 1, base zero for all others. Valid values are from 1 to 12. This operand is required. |
|---|
| Displacement, base zero, of the field in the section This operand is required. |
|---|
|
GConst(integer) GConst(“char string”)
| Returns the address and length of some constant value, independent of the current Event record The value might be a signed 64-bit integer or a character string up to 32 characters in length. | Constant integer to be returned Code an integer between the minimum and the maximum 64-bit signed integer, approximately +/- 18 * 1018. |
|---|
| 0–32 character string, enclosed in quotes. |
|---|
|
| Returns the address of an unsigned 32-bit integer representing the CPU time used by BMC AMI Defender expressed as microseconds divided by a specified divisor GCPUtime takes no parameters. | CPU time divisor For example, specifying 1 causes GCPUtime to return the CPU time in microseconds. Specifying 1000 causes GCPUtime to return the CPU time in millisecond. This operand is required. |
|---|
|
GDB2hdr(header_type displacement [length])
| Returns the address of a field in a DB2 SMF header | Type number of a DB2 header such as 1, 2, 4, 8, 16 or 32 This operand is required. |
|---|
| Displacement, base zero, of the field in the specified header This operand is required. |
|---|
| Length of the data field This operand is optional; if you omit, GDB2hdr returns the length from displacement to the end of the header. If you code length and displacement plus length is greater than the length of the header, then the field is treated as not addressable. |
|---|
|
GExt14(section_type displacement length) | Returns SMF 14/15 Section Data | The SMF 14/15 Extended Information Segment section type. This is a number from 1 to 9. 1 COMPRESSED FORMAT D/S
2 SMS CLASS INFORMATION
3 STEP INFORMATION
4 ANSI VERSION 4 CCSID
5 ADDTIONAL DATA SET CHARACTERISTICS
6 PDSE STATISTICS
7 KEK LABEL DATA FOR TAPE HARDWARE ENCRYPTION
8 RAS
9 DASD Data Set Encryption |
|---|
| Offset within the Extended Information Segment This offset must include the offset for the 4 byte segment prefix. The first field in the segment begins at offset 4. |
|---|
| Length of the fixed-length SMF 14/15 field |
|---|
|
GFList(displacement length)
| Returns an offset from the address returned by the FFlist field’s Get specification Intended to be used only with fields subsidiary to FFlist. See Grouping-related-fields-with-FFlist-and-Gflist. | Displacement, base zero, of the field in from the address returned by the FFlist field’s GET specification This operand is required. |
|---|
| Length of the field This operand is required. |
|---|
|
GIfElse(CondSpecification(…) GetSpecificationA(…) GetSpecificationB(…))
| Returns the result of either of two Get specifications depending on whether the result of a specified Condition specification is true or false | Name of a Condition specification, and the parameters for that Condition specification The Condition specification specifies a condition to be tested to determine which of the two Get specifications to invoke. This operand is required. |
|---|
GetSpecificationA(…) GetSpecificationB(…) | Names of two Get specifications and the parameters for those Get specifications The first Get specification specifies where the field data is to be located if the condition is true, and the second Get specification specifies where the field data is to be located if the condition is false. This operand is required. |
|---|
|
GIndexed(GetSpecification(…) int_fmt GetSpecificationIndex(...) [int_fmtn GetSpecificationIndexn(...) ...])
| Returns the address and length of a field located an offset beyond the address returned by the primary Get specification You can specify a single offset, or multiple offsets that are to be added together. | Name of a Get specification and the parameters for that Get specification The Get specification specifies the location and length of the data, assuming an index of zero. This operand is required. |
|---|
| Format of the index Specify any of the integer types from the Integer types table except UCharUChar and UNiblUNibl. This operand is required. |
|---|
| Name of a Get specification and the parameters for that Get specification The Get specification specifies the location and length of the index. This operand is required. |
|---|
| Format of the next index Specify any of the integer types from the Integer types table except UCharUChar and UNiblUNibl. This operand is required. |
|---|
GetSpecificationIndexn(…) | Name of a Get specification and the parameters for that Get specification The Get specification specifies the location and length of the next index. This operand is required. |
|---|
|
| Returns the address and length of data that is internal to BMC AMI Defender, that is, not part of an event record Label Label assigned to the internal data The label is case-insensitive: HOST_SAF, Host_SAF and host_saf are equivalent. This operand is required. Specify one of the following labels: | |
|---|
| Event subtype as determined by BMC AMI Defender , suitable for formatting with FInt(Long)This field is generally the same value as SMFXXSTY, but differs for events such as DB2 and SMF 90 that have subtypes in a non-standard location. BMC AMI Defender assigns a subtype of -1 to events without a defined subtype. | | CPU ID (CPU serial number) as 12 printable characters | | TCP/IP hostname as a character field of unknown length, suitable for formatting with FCstring | | Primary IPv4 address of the TCP/IP stack as a character field of unknown length, suitable for formatting with FCstring | | Primary IPv6 address of the TCP/IP stack of unknown length, suitable for formatting with FCstring | | JES node name as a character field of 8 characters | | LPAR name as a character field of 8 characters | | LPAR security subsystem type, expressed as an integer suitable for formatting with FInt(UChar): 0 = None, 1 = RACF, 2 = CA ACF2, 3 = CA Top Secret (TSS) | | LPAR security subsystem type, expressed as text of unknown length, suitable for formatting with FCstring: None, RACF, ACF2 or TSS | | SMF ID of the LPAR as a character field of 4 characters. | | System name (&SYSNAME as defined in the IEASYSxx or IEASYMxx parmlib member) as a character field of 8 characters | | Name of the z/OS installation exit or API from which the event record was received: API1, IEFU83, IEFU84, IEFU85 or IEFU86, as a character field of unknown length, suitable for formatting with FCstring | | | | RFC3164 facility expressed as a character string of unknown length, suitable for formatting with FInt(Long)For more information, see Syslog-facilities-and-severities.
| | | | | | Member name of current parameter file, expressed as a character field of unknown length, suitable for formatting with FCstring | | SIEM Type: RFC3164, CEF, Splunk, LEEF, DAM/DAMVISualizer or JSON, expressed as a character field of unknown length, suitable for formatting with FCstring | | BMC AMI Defender version in format v.r.m as a character field of 6 bytesThe length is subject to change in future releases. |
|
GIPAdj(GetSpecification(…))
| Returns an IP address in character form that has been adjusted so that it is a proper IPv4 address An IPv6 address that cannot be converted to an IPv4 address is returned as 255.255.255.255. | Names of a Get specification and the parameters for that Get specification The Get specification specifies where the IP address data in character form is located. This operand is required. |
|---|
|
GJES(type_number displacement)
| Returns the address and length of data in a JES2/3 purge record section | Specifies the entry type number: 8: Descriptor section
7: Events section
6: Actuals section
5: JES2 network section
4: JES2 routing section
3: Print section
1: Triplet section This operand is required. |
|---|
| Displacement, base zero, of the field in the section This operand is required. |
|---|
|
GNAF(record_number displacement)
| Returns the address and length of data in a SuperSession NAF record | Specifies the entry record number: X’00’ = Startup record
X’01’ = Shutdown record
X’02’ = Entry validation record
X’E0’ = CL/SuperSession user logon
X’E1’ = CL/SuperSession user logoff
X’E2’ = CL/SuperSession terminal logon
X’E3’ = CL/SuperSession terminal logoff
X’F0’ = CL/SuperSession logon
X’F1’ = CL/SuperSession logoff
X’F3’ = Gateway limit reached
X’F4’ = CL/SuperSession SINGLE start
X’F5’ = CL/SuperSession SINGLE stop
X’C0’ = Super Session user record layout This operand is required. |
|---|
| Displacement, base zero, of the field in the section |
|---|
|
GNestedTripletFW(First_Outer_Triplet_Displacement
Outer_Triplet_Count_Displacement
First_Inner_Triplet_Displacement
Inner_Triplet_Count_Displacement
Data_Field_Displacement Outer_Triplet_Count_Adjustment)
| Supporting two levels of triplet processing, processes a triplet that points to a data section which contains another set of triplets that point to its own data sections This supports a table of multiple triplets, which can point to data sections, which can include a table of multiple triplets and further data sections. A field in the event record must reflect the number of triplets. This specification supports only fullword (that is, 12-byte) triplets. The triplet displacement, length, and count must each be a fullword in length. First_Outer_Triplet_Displacement | Offset to the first triplet in the table of triplets The offset is relative to the start of the event record (RDW). |
|---|
Outer_Triplet_Count_Displacement | Offset to the event record field that contains the number of triplets This must be the offset to a fullword data element. This offset is relative to the start of the event record (RDW). |
|---|
First_Inner_Triplet_Displacement | Offset to the first subordinate (or inner) triplet in a table of triplets The offset is relative to the data section pointed to by the outer triplet. |
|---|
Inner_Triplet_Count_Displacement | Offset to the event record field that contains the number of triplets This must be the offset to a fullword data element. This offset is relative to the data section pointed to by the outer triplet. |
|---|
| Offset from the inner data section, pointed to by the inner triplet to the data element being selected |
|---|
Outer_Triplet_Count_Adjustment | Outer triplet count within the event record can include other triplets within the record This is a numeric count field that can be used to deduct from the total number of triplets store in the record (pointed to by Outer_Triplet_Count_Displacement). |
|---|
|
| The GNull specification is a special Get specification that might be used with Format specifications such as FFlist that do not require a field value address. GNull always returns an address and length of zero. GNull takes no parameters. |
GOffset(GetSpecification(…) displacement length_adjustment)
| Returns the address and length of a field value that consists of a 16-bit displacement in a variable section that points to a 16-bit length followed by the actual value | Name of a Get specification and the parameters for that Get specification The Get specification specifies the location of the Event record segment containing the pointer, length, and data. This operand is required. |
|---|
| Offset of the displacement pointer from the address returned by the Get specification, base 0 This operand is required. |
|---|
| Adjustment to be made to the length value in the record For example, some length values include their own size, so a length_adjustment of -2 would be appropriate. This operand is required. |
|---|
|
GOffsetBase(offset_of_pointer offset_of_data [length]) | Returns the address and length of a field value that is some fixed displacement into a structure pointed to by a 16-bit displacement in the base section of an Event record | Offset, base zero, into the base of an Event record, of a 16-bit displacement to the structure containing the field value This operand is required. |
|---|
| Offset, base zero, of the data value into the structure pointed to by the displacement value This operand is required. |
|---|
| Length of the field This operand is optional. If you omit, then the length of the data must be known by the Format specification. |
|---|
|
GPreamble(displacement length) | Returns the address and length of a value in the base of the preamble for an SMF record or API 1 event The preamble has a BMC-defined format and is subject to change. | Displacement of the value relative to zero and including the record control word (llbb). This operand is required. |
|---|
| Length of the value This operand is required. |
|---|
|
| If the field type is coded as ESC or omitted, returns a 1-byte code indicating the privilege status of the SMF enrichment user IDGPriv takes no operands. For more information, see Privilege escalation detection in the "SMF record enrichment" topic. ESC
The code values are as follows: | |
|---|
| Not a privileged userBecause the value is blank, it would normally suppress and not be transmitted (assuming OPTions FORMAT(ERGO). | | Escalated privilegesThis user ID was last seen as unprivileged or with lesser privileges, but now has escalated. | | Known privileged userThis user ID has been seen before, and the last time it was seen, it had the same privileges as currently seen. | | New privileged userThis is the first time this user ID is seen in the current execution of BMC AMI Defender, and the user is privileged. |
CHG - If the field type is coded as CHG, returns a 32-bit unsigned integer, the low-order, 8 bits of which correspond to the escalation change in ACEEFLG1
- If no escalation has occurred, returns zero
For example, if the escalation were from not SPECIAL to SPECIAL, the returned integer is X'00000080'.
|
GRelo(type_number displacement)
GRelo (for SMF 80/TSS)
GRelo81 (for SMF 81)
GRelo83 (for SMF 83) | Returns the address and length of data in a RACF relocate section Relocate sections are documented in the IBM z/OS Security Server RACF Macros and Interfaces Manual. | Relocate section type number. You might specify a non-extended length relocate section (type numbers less than 256) or an extended-length relocate section (type numbers 256 and above) Code a number between 1–999. (As of RACF V2R1 the maximum IBM-defined Extended Relocate type is 429.) This operand is required. |
|---|
| Displacement, base zero, of the field in the relocate section This operand is required. |
|---|
|
GRept(GetSpecification(…) length_each [max_count]) | Returns the address and length of a field or set of fields that repeat within a section The section might occur once or multiple times (such as GRelo, GTriplet). The addressed data might be a single field or multiple fields to be formatted with FFlist. | Name of a Get specification and the parameters for that Get specification The Get specification specifies the location of the first element of the repeating data. This operand is required. |
|---|
| Length of each field or set of fields in the series of repetitions This operand is required. |
|---|
| Maximum number of repetitions per section Code a number between 1–65535. This operand is optional; if you omit, it defaults to unlimited, and the number of fields or sets of fields is limited only by the length of the containing section. |
|---|
|
| Returns an 8-byte STCK (store clock) value corresponding to the current hardware clock time GTime takes no operands. The non-extended hardware clock will wrap to zero on 17-Sep-2042; consider using GTimeE() instead. |
| Rreturns a 16-byte STCKE (store clock extended) value corresponding to the current hardware clock time GTimeE takes no operands. |
GTriplet(offset_of_triplet | GetSpecTriplet(…) displacement [OCCURrence(occurrence)]) GTripletFW(offset_of_triplet | GetSpecTriplet(…) displacement [OCCURrence(occurrence)])
| Returns the address and length of fields in one or more Event record sections pointed to by a triplet of a non-DB2 Event record GTriplet specification supports 8-byte triplets. The triplet displacement must be 4 bytes. The length and count must each be 2 bytes in length. GTripletFW specification supports only fullword (that is, 12-byte) triplets. The triplet displacement, length, and count must each be a fullword in length. SMF triplets are documented in the IBM Manual System Management Facilities. | Offset of the pointer triplet in the base of the Event record Specify a number in Signed Extended Numeric Format between the minimum and maximum permitted triplet offsets for the event (See TYPE-and-RETYPE-statements). Either offset_of_triplet or GetSpecTriplet(…) is required. |
|---|
| Code a Get specification for the location of the triplet Specify any valid Get specification except GNull. Any length returned by the Get specification is ignored; a triplet length of 8 is assumed. Either offset_of_triplet or GetSpecTriplet(…) is required |
|---|
| Displacement, base zero, of the field in the section This operand is required. |
|---|
| Specifies that GTriplet is to return only a single specified occurrence of the triplet record sections Specify an occurrence number between 1–32767 inclusive. If the specified number is greater than the number of occurrences indicated by the triplet in the record, then GTriplet returns not present for the field. This operand is optional; if you omit OCCURrence then all occurrences are returned in succession. |
|---|
|
GTripletArray(offset_of_triplet | GetSpecTriplet(…) displacement [count_format]) | Returns the address and length of the elements of an array of fields in an Event record sections pointed to by a triplet, other than in a DB2 SMF record Each entry in the array is assumed to be preceded by a half-word length of the entry. SMF triplets are documented in the IBM documentation. | Offset of the pointer triplet in the base of the Event record. This operand is required. |
|---|
| Code a Get specification for the location of the triplet Specify any valid Get specification except GNull. Any length returned by the Get specification is ignored; a triplet length of 8 is assumed. Either offset_of_triplet or GetSpecTriplet(…) is required. |
|---|
| Displacement, base zero, of the first field of the array in the section This operand is required. |
|---|
|
GTripletDB2(offset_of_triplet displacement [length [length_adjust]]) | Returns the address and length of fields in one or more SMF record sections pointed to by a triplet of a DB2 SMF record DB2 SMF triplets are documented in IBM documentation, for example, DB2 10 for z/OS Managing Performance. GTripletDB2First is identical to GTripletDB2 but only returns the first instance of the field. | Offset of the pointer triplet in the base of the Event record. This operand is required. |
|---|
| Displacement, base zero, of the field in the section. This operand is required. |
|---|
| Length of the field. This operand is optional. If you omit, then the length of the data must be known by the Format specification. If you are coding length only as a placeholder for length_adjust, then code 32767. |
|---|
| For Db2 variable-length segments where the length in the triplet is zero, specifies any adjustment to be made to the length value in the record For example, some length values include their own size, so a length_adjustment of -2 would be appropriate. This operand is optional. If you omit, it defaults to zero, that is, the length in the length value is the exact length of the data without the length field. |
|---|
|
GTripletTable(First_Triplet_Displacement
Triplet_Count_Displacement
Data_Field_Displacement
Triplet_Count_Adjustment) GTripletTableFW(First_Triplet_Displacement
Triplet_Count_Displacement
Data_Field_Displacement
Triplet_Count_Adjustment) | Supports a table of multiple triplets which can point to multiple data sections A field in the event record must reflect the number of triplets. GTripletTable specification supports 8-byte triplets. The triplet displacement must be 4 bytes. The length and count must each be 2 bytes in length. GTripletFW specification supports only fullword (that is, 12-byte) triplets. The triplet displacement, length, and count must each be a fullword in length. First_Triplet_Displacement | Offset to the first triplet in the table of triplets The offset is relative to the start of the event record (RDW). |
|---|
Triplet_Count_Displacement | Offset to the event record field that contains the number of triplets This must be the offset to a fullword data element. The offset is relative to the start of the event record (RDW). |
|---|
| Offset from the inner data section, pointed to by the triplet to the data element being selected |
|---|
| Triplet count within the event record can include other triplets within the record This is a numeric count field that can be used to deduct from the total number of triplets stored in the record (pointed to by Triplet_Count_Displacement). |
|---|
|
GTripletXLen(offset_of_triplet displacement_of_length displacement_of_field [length_adjustment])
| Returns the address and length of a field with an explicit length in an Event record section pointed to by a triplet Compare GXlen, that is more flexible in its specification. | Offset of the pointer triplet in the base of the Event record This operand is required. |
|---|
| Displacement, base zero, of the length halfword in the section This operand is required. |
|---|
| Displacement, base zero, of the field in the section This operand is required. |
|---|
| An adjustment to be applied to the length to obtain the actual length of the field This operand is optional. If you omit, the length in the Event record is used directly as the length of the field. |
|---|
|
GTwoLoc(GetSection(…) displacement_of_fixed length displacement_of_pointer) | Used to get the address and length of a field that is present in one or possibly two locations in an Event record: a fixed-length field, and a variable-length field that is populated if the data is longer than the fixed-length field Compare GXlen that is not limited to triplet-located data. | Name of a Get specification and the parameters for that Get specification The Get specification specifies the location of the Event record segment containing the length and data fields. GetSection would typically be GBase or GTripletDB2. This operand is required. |
|---|
| Displacement, base zero, of the fixed-length field This operand is required. |
|---|
| Length of the fixed-length field This operand is required. |
|---|
| Displacement, base zero, of a 16-bit pointer containing the offset from the base of the section to the variable-length field Displacement is assumed to begin with a 16-bit length field preceding the actual data. This operand is required. |
|---|
|
GUToken(FieldNum , GetTokenArea(…)) | Returns the external token by calling RACROUTE TOKENMAP macro for the given user token | Specify any value between 1-3 1 = Terminal ID 2 = User ID 3 = Group ID This operand is required. |
|---|
| Location of the user token in the record Specify any valid Get specification except GNull. This operand is required. |
|---|
|
GXLen(GetSpecificationOffset(...) int_fmt GetSpecificationLength(...) [length_adjustment]) | Returns the address and length of a field with an explicit length in any part of the event record The length returned is the lesser of the length returned by GetSpecificationOffset or the explicit length field, adjusted as specified. Compare GTripletXlen that might be more efficient or easier to use if the data and the length are located in a triplet-located section. GetSpecificationOffset(…) | Name of a Get specification that specifies the offset or location of the data field and the parameters for that Get specification This operand is required. |
|---|
| Format of the index Specify any of the integer types from the Integer types table except UCharUChar and UNiblUNibl. This operand is required. |
|---|
GetSpecificationLength(…) | Name of a Get specification that specifies the offset or location of the explicit length field and the parameters for that Get specification This operand is required. |
|---|
| Adjustment to be applied to the length to obtain the actual length of the field This operand is optional. If you omit, then the length in the Event record is used directly as the length of the field. |
|---|
|