$delim (delim-flag, parse-spec) function - Documentation for BMC Defender SIEM Correlation Server 6.1
Jessica Cortez This function accepts two arguments. The first argument is one of the following delimiter keywords: space, comma, colon, semi, pipe, dash, amp, plus, pct, hash, sp-dash, punct, bquote, cef, or eol.
- sp-dash is a space followed by a hyphen character
- bquote takes a balanced (closing) quotation mark as the delimiter, which includes "",//,(),[],{},<>
For more information about the delimiters, see Parse delimiters.
The function executes the parse specification using a delimiter character other than the standard space character.
The following examples show target strings, parse expressions, and return values:
Target string | Parse expression | Return value |
|---|---|---|
A|B|C|D|E | $delim (pipe, $3) | C |
User=test, Device=dev001 | $delim (comma, $2) | device=dev001 |
User USR01|Device dev001|Code 0x0 | $delim (space, device *) | dev001|code Explanation: The return value includes the pipe character because the delimiter is space. |
User USR01|Device DEV001|Code 0x0 | $delim (pipe, device *) | dev001 Explanation: Only the device name, delimited by pipe, is returned. |
XXX=A1;YYY=A2 | $delim (punct, $2) | A1 Explanation: The second field is returned, delimited by punct (any punctuation). |
User: test001 – Location: dev001 – value: ABC | $delim (dash, 2) | location: dev001 Explanation: The second field is returned, delimited by dash. |
A,B,C,D,E | $delim (pipe, $4) | No match. No pipe delimiters. |
| User: test001 – Location: {dev001,dev002} – value: ABC | $delim (bquote,Location: {*}) | dev001,dev002 Explanation: The expression matches and the delimiter is selected as SPACE because { & } are provided in parse-spec. |
| User: test001 – Location: {dev001,dev002} – value: ABC | $delim(bquote,Location: *) | dev001,dev002 Explanation: The expression matches and the delimiter selected as }. |
| User: test001 – Location: {dev001,dev002} – value: ABC | $delim(eol,Location: *) | {dev001,dev002} - value: ABC Explanation: The expression matches and as * is used in parse-spec, the value is returned till the end of the string. |
| User: test001 – Location: {dev001,dev002} – value: ABC | $delim(eol,Location: {*}) | dev001,dev002 Explanation: The expression matches and as * is used in parse-spec with { and }, hence only dev001,dev002 returned. |
Related topic
