Using expressions in event maps

You can check field values and make substitutions based on processing statements.

For example you can use the following expression to check field values and make substitutions based on processing.

if (logical.name in $axces.target="UNKNOWN")
then (logical.name in $axces.target=network.name in $axces.target)
or
if (logical.name in $axces.target=NULL
then (logical.name in $axces.target="?"+str(tod()))

In this example, the value the value in network.name replaces logical.name if logical.name is UNKNOWN. The second statement sets logical.name to a constant if it is NULL.

Other common uses for expressions are to set the value of a field to the current date and time and to calculate a value based on information in the record. Event Services applications handles data type and case conversions as long as the Field Type field is correctly identified and the data is written to the descriptor structure.

You can use a single Format Control record named login.event to establish initial global variables (such as lists of valid operators) when the event agent is started, just as you can for users when they log into Service Manager.

If you are writing data to a field whose name exists in more than one structure in a record, you must explicitly name the field. For example, if you add a field named assignment to the middle structure of your incident database dictionary record and you want to manipulate that field, you must identify it as middle,assignment. The field must exist in the target file before any instruction can manipulate it. Ensure the data type is correctly identified.

Related topics

Event mapping process
Example: Mapping to multiple tables
Mapping events
Rules for building maps
Using event maps