1 Macro functions

Macro functions offer the ability to customize macro values (for example, shorten or extract specific substrings), making them easier to work with.

All functions listed here are supported with all types of macros:

• Built-in macros
• User macros
• Low-level discovery macros
• Expression macros

Macro functions can be used in all locations supporting the listed macros. This applies unless explicitly stated that only a macro is expected (for example, when configuring host macros or low-level discovery rule filters).

The functions are listed without additional information. Click on the function to see the full details.

Function details

The syntax of a macro function is:

{macro.func(params)}

• macro - the macro to customize, for example {ITEM.VALUE} or {#LLDMACRO};
• func - the function to apply;
• params - a comma-delimited list of function parameters, which must be quoted if:
  • start with a space or double quotes;
  • contain closing parentheses "``" or a comma.

Optional function parameters are indicated by < >.

btoa

Encoding a macro value into Base64 format.

fmtnum(digits)

Number formatting to control the number of digits printed after the decimal point.

Parameters:

• digits - the number of digits after decimal point. Valid range: 0-20. No trailing zeros will be produced.

Examples:

fmttime(format,<time_shift>)

Time formatting.
Note that this function can be used with macros that resolve to a value in one of the following time formats:

• hh:mm:ss
• yyyy-mm-ddThh:mm:ss[tz] (ISO8601 standard)
• unix timestamp

Parameters:

• format - mandatory format string, compatible with strftime function formatting;
  
• time_shift (optional) - the time shift applied to the time before formatting; should start with -<N><time_unit> or +<N><time_unit>, where:
  
  • N - the number of time units to add or subtract;
  • time_unit - h (hour), d (day), w (week), M (month) or y (year).

Comments:

• The time_shift parameter supports multistep time operations and may include /<time_unit> for shifting to the beginning of the time unit (/d - midnight, /w - 1st day of the week (Monday), /M - 1st day of the month, etc.). Examples: -1w - exactly 7 days back; -1w/w - Monday of the previous week; -1w/w+1d - Tuesday of the previous week.
• Time operations are calculated from left to right without priorities. For example, -1M/d+1h/w will be parsed as ((-1M/d)+1h)/w.

Examples:

htmldecode

Decoding a macro value from HTML encoding.

htmlencode

Encoding a macro value into HTML encoding.

iregsub(pattern,output)

Substring extraction by a regular expression match (case-insensitive).

Parameters:

• pattern - the regular expression to match;
• output - the output options. \1 - \9 placeholders are supported to capture groups. \0 returns the matched text.

Comments:

• If the function pattern is an incorrect regular expression, then the macro evaluates to 'UNKNOWN' (except for low-level discovery macros, in which case the function will be ignored, and the macro will remain unresolved).

lowercase

Transformation of macro value characters into lowercase.

regrepl(pattern,replacement,<pattern2>,<replacement2>,...)

Replacement of character/substring in macro value.

Parameters:

• pattern - the regular expression to match;
• replacement - the replacement string.

Comments:

• The patterns and replacements are processed sequentially, with each subsequent pair being applied in accordance with the outcome of the previous replacement;
• This function also allows referencing captured groups in replacement strings using \1 to \9 placeholders.

Examples:

{{ITEM.VALUE}.regrepl("oldParam", "newParam")} - replace "oldParam" with "newParam"
       {{ITEM.VALUE}.regrepl("([^a-z])","\\\1")} - escape all non-letter characters with a backslash
       {{ITEM.VALUE}.regrepl("_v1\.0", "_v2.0", "\(final\)", "")} - replace multiple parts in item value

regsub(pattern,output)

Substring extraction by a regular expression match (case-sensitive).

Parameters:

• pattern - the regular expression to match;
• output - the output options. \1 - \9 placeholders are supported to capture groups. \0 returns the matched text.

Comments:

• If the function pattern is an incorrect regular expression, then the macro evaluates to 'UNKNOWN' (except for low-level discovery macros, in which case the function will be ignored, and the macro will remain unresolved).

Examples:

tr(characters,replacement)

Transliteration of macro value characters.

• characters - the set of characters to replace;
• replacement - the set of positionally corresponding replacement characters.

Examples:

{{ITEM.VALUE}.tr(abc, xyz)} - replace all occurrences of a with x, b with y, c with z
       {{ITEM.VALUE}.tr(abc, xyzq)} - replace all occurrences of a with x, b with y, c with z (q is ignored)
       {{ITEM.VALUE}.tr(abcde, xyz)} - replace all occurrences of a with x, b with y, c with z, d with z, e with z (i.e. xyzzz)
       {{ITEM.VALUE}.tr("\\\'", "\/\"")} - replace all occurrences of backslash with forward slash, ' with "
       {{ITEM.VALUE}.tr(A-Z,a-z)} - convert all letters to lowercase
       {{ITEM.VALUE}.tr(0-9a-z,*)} - replace all numbers and lowercase letters with "*"
       {{ITEM.VALUE}.tr(0-9,ab)} - replace all occurrences of 0 with a, and replace all occurrences of 1, 2, 3, 4, 5, 6, 7, 8, and 9 with b
       {{ITEM.VALUE}.tr(0-9abcA-L,*)} - replace all numbers, abc characters, and A-L range with "*"
       {{ITEM.VALUE}.tr("\n","*")} - replace end-of-line occurencies with *
       {{ITEM.VALUE}.tr("e", "\n")} - replace all "e" to end-of-line

To include literal characters:

backslash - must be escaped as \\
       single quote - must be escaped as \'
       double quote - must be escaped as \"

Supported escape sequences with backslash:

\\\\ => \\ - double backslash to single backslash
       \\a  => \a - alert
       \\b  => \b - backspace
       \\f  => \f - form feed
       \\n  => \n - newline
       \\r  => \r - return
       \\t  => \t - horizontal tab
       \\v  => \v - vertical tab

uppercase

Transformation of macro value characters into uppercase.

urldecode

Decoding a macro value from URL encoding.

urlencode

Encoding a macro value into URL encoding.