Below is the Event Message that contains a Ticket ID, we need to extract the Ticket ID value?i.e, 3973309 and update 'UserAttribute1'
Let's say this event is from the NSM or Spectrum Connector
1. Create Event Enrichment Policy using Script
2. Use the Parse function to extract required value (i.e. - Ticket ID) from the Alert 'Summary'
Then assign the extracted value to a Variable $myretval as shown below:
3. Last step: assign this policy a connector, in this example, we assigned to MTC
Since MTC is installed and running on the SOI Manager node, the policy will get applied to MTC running on the SOI Manager.
4. Create a VB script and save this file to C:\Test\test.vbs on the SOI Manager node
Ex: If the policy gets applied to the MidTier connector, then copy .vbs to SOI Manager node
Ex: If the policy gets applied to the SpIM connector node, then copy the file to SpIM connector node
Now, the policy is deployed to MTC and when a new alert generated with above Message (Step 1)?UserAttribute1 field is updated with TicketID value