Match a String Against Regex in Pipeline Processors


(GT) #1
rule "TargetWorkstation"
when
to_string($message.TargetUserName)regex("(.*)\$", TargetUserName)
then
rename_field("TargetUserName", "TargetWorkstationName");
end

Hi guys, above you can see my attempt at matching a string with regex in a pipeline processor.
My aim is when the field TargetUserName ends with a dollar sign I would like the change the field name to TargetWorkstationName, I am just not sure how to match the field against the regex.

Regards,
George


(Jochen) #2

You can access the boolean matches property of the result:


Subnet Search Query
(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.