$regex (regex-patt, optional-parse-spec) function
This function is identical to the match-key-phrase-parse-spec-function, except that the first argument keyword or phrase is a Berkley regular expression instead of a BMC Defender match pattern. The function returns the results of the parse specification only if regex-patt appears somewhere in the message content. This expands the capability of the system to permit usage of Berkley regular expressions for match patterns.
In the special case where the optional parse-spec argument is omitted, the function can be used in threads and alerts to match the thread using the Berkley regex match patterns (rather than the BMC Defender match pattern syntax).
The following examples show target strings, parse expressions, and return values:
Target string | Parse expression | Return value |
|---|---|---|
NUM 12345 Test | $regex (NUM.*Test) | Expression matches the word NUM, followed by one or more characters, followed by Test The standard regex pattern of .* is required here. |
The admin user test001 has logged on | $regex (has logged on, $2) | admin matches, and the second word is returned |
root has logged in. | $regex (logged out) | Expression does not match, expecting logged out |
abcde test | $regex ([A-Z]) | At least one upper case letter is required to match |
192.168.1.1
| $regex ([0-9]+\. [0-9]+\. [0-9]+\. [0-9]+) | Expression matches an IP address, but other strings might also match
|
Related topic