Event Enrichment Policy - Extract a string(value) from Message\Summary field and update 'UserAttribute' fields

Document ID : KB000009416
Last Modified Date : 14/02/2018
Show Technical Document Details
Introduction:

How to extract a value like 'TicketID' from Event Message and update another field like 'UserAttribute' using Event Enrichment Policy

Environment:
SOI 3.3, 4.0 & 4.2
Instructions:

 

Below is the Event Message that contains a Ticket ID, we need to extract the Ticket ID value?i.e, 3973309 and update 'UserAttribute1'

Let's say this event is from the NSM or Spectrum Connector

Figure 1

1. Create Event Enrichment Policy using Script

11.png

12.png

13.png

2. Use the Parse function to extract required value (i.e. - Ticket ID) from the Alert 'Summary'
        fn:Parse(${pattern1.Summary},'.*=(.*)')

Then assign the extracted value to a Variable $myretval as shown below:

3.png

3. Last step: assign this policy a connector, in this example, we assigned to MTC

2.png

Since MTC is installed and running on the SOI Manager node, the policy will get applied to MTC running on the SOI Manager.

4. Create a VB script and save this file to C:\Test\test.vbs on the SOI Manager node

Figure 7

Note:
Ex: If the policy gets applied to the MidTier connector, then copy .vbs to SOI Manager node

Ex: If the policy gets applied to the SpIM connector node, then copy the file to SpIM connector node

Now, the policy is deployed to MTC and when a new alert generated with above Message (Step 1)?UserAttribute1 field is updated with TicketID value

1.png