Parse delimiters: arguments for the $delim() function
By default, when a parse function is executed, the returned text is delimited by a trailing space character. This behavior can be changed by nesting the parse function in the $delim() function discussed previously. This permits other delimiters (besides a space) to denote the end of the parsed string. The $delim() function is previously discussed in this section; a description of the delimiter flags that can be used as the first argument of the $delim() function is provided as follows:
Delimiter | Description |
|---|---|
space | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by a space. This is the default delimiter (hence this flag is included as a delimiter option mainly for completeness). |
comma | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next comma character, or end of line. |
colon | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next colon (:) character, or end of line. |
semi | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next semi-colon character (;), or end of line. |
pipe | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next pipe character (|) or the end of line. |
dash | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next hyphen character (-) or end of line. |
amp | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next ampersand character (&) or end of line. |
plus | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next plus character (+) or end of line. |
hash | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next hash character (#) or end of line. |
atsign | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next at sign character (@) or end of line. |
pct | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next percent character (%) or end of line. |
punct | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the punctuation character, where any punctuation character including the preceding ones, can delimit the return value. |
sp-dash | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next space character followed by a hyphen character (- ). The space dash combination of characters is used extensively in message context to delimit fields such as AAA - BBB - CCC, hence this special type of delimiter might be used frequently when parsing Windows agent (and other) messages. |
bquote | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the next double quoted string. The second double quote mark in the string can delimit the value (and the value is returned with the balanced quote marks removed). |
cef | This delimiter, used as the first argument of the $delim() function, can delimit the returned parsed value by the start of the next CEF style field, where the CEF field is in the form label=value. The string preceding the next field is returned. If CEF is used, the parse function is quite useful (since CEF is notoriously hard to parse by any sort of program). |
eol | This delimiter, used as the first argument of the $delim() function, delimits the returned parsed value by the end of line. This is only useful when the text that is targeted is delimited by the end of line and not some other delimiter. |
These delimiters provide a large amount of flexibility when parsing strings, especially when a string is to include multiple blank spaces (as might be the case for a variety of fields contained in messages). Any parsed string is returned with spaces replaced with underscores. The maximum size of any returned value is 100 characters.
Related topic