Calculated fields

Calculation fields are supported in Log File Monitor.

To define a calculation field, use field type *CALC. The Start, Len, Dec and Number fields are not used with *CALC fields and should be left blank. The value for the *CALC field comes from a function which you must define. To do this:

  1. Position the cursor to the required *CALC field and press F16= Change Function.
  2. Enter the function in the window.
Functions

In addition to *CALC fields, you may also attach a function to a normal field. To do this:

  1. Position the cursor to the required field and press F16= Change Function.

To get a list of functions press F4= Prompt.

From the list of retrieved functions, use 1=Select against the required function to insert it at the current cursor location. This inserts both the function and a template to show you the attributes of the function that need to be competed in order for it to operate correctly.

To view a list of other fields in this rule group that can be used, press F18= List fields.

For full information on supported functions, see Functions.

Functions are mandatory for *CALC fields but optional for normal fields. If you attach a function to a normal field, the original field value is no longer available. Any other field or rule that refers to that field will instead see the value returned by the function.

The function values must comprise a function, an expression or a combination of both. Simple constants, are not allowed. For example, you cannot just type a number or a character value, however you can return a constant by using the %CONST function.

Functions can refer to fields as follows:

*CALC field:

  • Can refer to any non-*CALC field.
  • Can refer to *CALC fields that precede it in the list of fields.
  • Cannot refer to *CALC fields that follow it in the list of fields.
  • Cannot refer to self.

Non-*CALC fields that have an attached function:

  • Can only refer to self.
  • Cannot refer to any other field.
EXAMPLE: Attached Function Examples

If you have defined a *CHAR field called FIELD01 and want the value to form part of the alert text in an action, but the case is variable and you want to normalize it to always be upper case. To achieve this, attach the following function:

%UCASE(&FIELD01)

Or if you want the first character to be upper case and the remainder to be lower case, attach this function:

%UCASE(%SUBST(&FIELD01,1,1)) *CAT %LCASE(%SUBST(&FIELD01,2))

EXAMPLE: An example of using *CALC fields

A *CHAR field contains the following text and you want to create a rule to be able check system name and IP address. You need to extract the required data but a simple %SUBST function cannot be used because the position and length of this data varies within the text.

System DEMSRV1 contacted at IP address 10.72.72.51 on port 15000

System DEV201_1 contacted at IP address 10.72.49.250 on port 15000

System HWSSRV2K contacted at IP address 10.72.72.26 on port 15000

System HGR542P2 contacted at IP address 10.72.73.43 on port 15081

System HBD983P2 contacted at IP address 10.72.73.55 on port 15000

System P3QA contacted at IP address 10.72.73.43 on port 15051

System HCS922P1 contacted at IP address 10.72.73.41 on port 15051

There are two ways of doing this:

Method 1:

You could use a %SUBST function to extract the data, and use %SCAN functions to calculate the starting positions and length, but this is complicated:

SYS: %Subst(&MSG,8,%Scan('contacted',&MSG) - 9)

IP: %Subst(&MSG,%Scan('IP address',&MSG) + 11,%Scan('on port',&MSG) - %Scan('IP address',&MSG) - 12)

Method 2:

An easier method is available using the %EXTRACT function. Like %SUBST this extracts a substring, but it picks out the data by specifying the adjacent text rather than the start position and length:

SYS: %Extract(&MSG,*Between,'IP address','on port')

IP: %Extract(&MSG,*Between,'on port','.')