Event Rule - Regular Expression to remove a certain part of the String

[Ashok10]

Hi There,

I am trying to write a regular expression in the event rule Transform section. I am getting extra characters in FQDN and i am trying to remove them.

The example strings are :

abcd-asm.vdcunix.local

abcdasm.vdcunix.local

i am trying to remove asm and -asm from the string. I used (\|*-asm|asm\|*) but it is returning as Unknown . 

Expected outputs is:  abcd.vdcunix.local

Kindly help me with expression here.

[Ashok10]

Alexey,

Now its working as expected.I used ^((?:\S+\s+){1}\S+).*

Thanks

[Alexey7]

Awesome!

Consider a little modification to the regex ^((\S+\s+){1}\S+), I don't think you really need ?: here.

[SteveMac1]

Look into the EvtMgmtCustom_PostBind_Update, EvtMgmtCustom_PostBind_Create and possible the EvtMgmtCustom_PostTransformHandler script includes. 

Documentation (minimal as it is) is here: https://docs.servicenow.com/bundle/kingston-it-operations-management/page/product/event-management/r...

You will want to be extra careful on the EvtMgmtCustom_PostTransformHandler script include; that runs on the Events so any overhead to the Event processing can slow down the whole EM processing. The other two operate on the alert so they are not AS big of a deal. In any case you want to (like all code) make sure it is efficient, especially if you have a large number of Events coming in. 

[patrickkenney]

For processing of Events only Event Rules are recommended by ServiceNow. Although the use of a Business rule, Script Include, or Advanced Script seems appealing, it is not a good idea.

To get what you need out of a field in an event, the contents needs to be consistent or you will need many rules to account for each scenario. If the field you are describing always has a format of "<word> Prod have issues" then you need a regex to capture the data prior to the words "Prod have issue" This can be done by using a regex of "(.*)Prod have issue". This regex would assign anything that is before the phrase "Prod have issue" into a named variable.

Regex in rules do not allow for complex formatting where the regex understands an or condition. The filter on the rule needs to identofy the events that the regex will work for or you will get <<UNKNOWN>> as the result in your variable.

[robertgeen]

Hello Ashok,

I just got back from vacation but here's the one suggestion I have for you. In order for regex to work in event management the entire content of it has to be captured. In this case you will want to have .* at the beginning and the end. You could try something like the following:

(.*)asm(.*) and and set them to 2 different variables. After that you can set more then likely the node field (I am assuming that's what you want to do) by doing ${variable}${variable} in the node field. That's probably your best bet. Let me know if I am aligning to what you want to do or if I am completely off basis. Thanks.