Macro functions offer the ability to customize macro values (for example, shorten or extract specific substrings), making them easier to work with.
All functions listed here are supported with all types of macros:
Macro functions can be used in all locations supporting the listed macros. This applies unless explicitly stated that only a macro is expected (for example, when configuring host macros or low-level discovery rule filters).
The functions are listed without additional information. Click on the function to see the full details.
Function | Description |
---|---|
fmtnum | Number formatting to control the number of digits printed after the decimal point. |
fmttime | Time formatting. |
iregsub | Substring extraction by a regular expression match (case-insensitive). |
regsub | Substring extraction by a regular expression match (case-sensitive). |
The syntax of a macro function is:
Optional function parameters are indicated by < >.
Number formatting to control the number of digits printed after the decimal point.
Parameters:
Examples:
Macro function | Received value | Output |
---|---|---|
{{ITEM.VALUE}.fmtnum(2)} |
24.3413523 |
24.34 |
{{ITEM.VALUE}.fmtnum(0)} |
24.3413523 |
24 |
Time formatting.
Note that this function can be used with macros that resolve to a value in one of the following time formats:
hh:mm:ss
yyyy-mm-ddThh:mm:ss[tz]
(ISO8601 standard)Parameters:
strftime
function formatting;-<N><time_unit>
or +<N><time_unit>
, where:N
- the number of time units to add or subtract;time_unit
- h (hour), d (day), w (week), M (month) or y (year).Comments:
time_shift
parameter supports multistep time operations and may include /<time_unit>
for shifting to the beginning of the time unit (/d
- midnight, /w
- 1st day of the week (Monday), /M
- 1st day of the month, etc.). Examples: -1w
- exactly 7 days back; -1w/w
- Monday of the previous week; -1w/w+1d
- Tuesday of the previous week.-1M/d+1h/w
will be parsed as ((-1M/d)+1h)/w
.Examples:
Macro function | Received value | Output |
---|---|---|
{{TIME}.fmttime(%B)} |
12:36:01 |
October |
{{TIME}.fmttime(%d %B,-1M/M)} |
12:36:01 |
1 September |
Substring extraction by a regular expression match (case-insensitive).
Parameters:
Comments:
Substring extraction by a regular expression match (case-sensitive).
Parameters:
Comments:
Examples:
Macro function | Received value | Output |
---|---|---|
{{ITEM.VALUE}.regsub(^[0-9]+, Problem)} |
123Log line |
Problem |
{{ITEM.VALUE}.regsub("^([0-9]+)", "Problem")} |
123 Log line |
Problem |
{{ITEM.VALUE}.regsub("^([0-9]+)", Problem ID: \1)} |
123 Log line |
Problem ID: 123 |
{{ITEM.VALUE}.regsub(".*", "Problem ID: \1")} |
Log line |
''Problem ID: '' |
{{ITEM.VALUE}.regsub("^(\w+).*?([0-9]+)", " Problem ID: \1_\2 ")} |
MySQL crashed errno 123 |
'' Problem ID: MySQL_123 '' |
{{ITEM.VALUE}.regsub("([1-9]+", "Problem ID: \1")} |
123 Log line |
*UNKNOWN* (invalid regular expression) |
{{#IFALIAS}.regsub("(.*)_([0-9]+)", \1)} |
customername_1 |
customername |
{{#IFALIAS}.regsub("(.*)_([0-9]+)", \2)} |
customername_1 |
1 |
{{#IFALIAS}.regsub("(.*)_([0-9]+", \1)} |
customername_1 |
{{#IFALIAS}.regsub("(.*)_([0-9]+", \1)} (invalid regular expression) |
{$MACRO:"{{#IFALIAS}.regsub(\"(.*)_([0-9]+)\", \1)}"} |
customername_1 |
{$MACRO:"customername"} |
{$MACRO:"{{#IFALIAS}.regsub(\"(.*)_([0-9]+)\", \2)}"} |
customername_1 |
{$MACRO:"1"} |
{$MACRO:"{{#IFALIAS}.regsub(\"(.*)_([0-9]+\", \1)}"} |
customername_1 |
{$MACRO:"{{#M}.regsub(\"(.*)_([0-9]+\", \1)}"} (invalid regular expression) |
"{$MACRO:\"{{#IFALIAS}.regsub(\\"(.*)_([0-9]+)\\", \1)}\"}" |
customername_1 |
"{$MACRO:\"customername\"}" |
"{$MACRO:\"{{#IFALIAS}.regsub(\\"(.*)_([0-9]+)\\", \2)}\"}" |
customername_1 |
"{$MACRO:\"1\"}") |
"{$MACRO:\"{{#IFALIAS}.regsub(\\"(.*)_([0-9]+\\", \1)}\"}" |
customername_1 |
"{$MACRO:\"{{#IFALIAS}.regsub(\\"(.*)_([0-9]+\\", \1)}\"}") (invalid regular expression) |