Valide Regex expression do not work for Event rule

Amar_Be · ‎08-03-2023

Hi

In an event rule, I'm trying to extract the name of a server from its FQDN (in the node field).

So I have ABCD.internal.server and I want to have ABCD what ever can be the other parts of the fqdn.

When I test the expression (\w+)\. on https://regex101.com/ it works very fine.

But once put in the "Transform and Compose Alert Output" tab of an event rule the regex returns nothing and a get a field with value "<<UNKNOWN>>" in the generated alert.

There is different expressions that can be used to extract the characters before the dot but none of them work once used in the alert rule.

Does any have already been able to do it?

Thanks

Amar_Be · ‎08-04-2023

I've found the solution.

The difference between Servicenow and regex101 is that service now need to first select all the message then isolate the desired part.

so (\w+) select nothing then try to isolate the first word.

(\w+).+ works as it first select everything then isolate the first word.

View solution in original post

Claude DAmico · ‎08-03-2023

Try something like this.

var str = "123456789ABCD.internal.server123456789";
var reg = /^(\w+)/;
var output = reg.exec(str)[1];
gs.print(output); //prints 123456789ABCD

Claude E. D'Amico, III - CSA

Amar_Be · ‎08-04-2023

Thank for your answer Claude.

But I've the same behavior (see attached screenshot).

It seems the issue is not in the regex but somewhere else.

Rahul Priyadars · ‎08-03-2023

Can you post Transform and Compose alert output tab - Expression Mapping?

Regards

RP

Amar_Be · ‎08-04-2023

Hi Rahul,

In your example the FQDN from the node field is used to map to the CI.

This is not what I'm doing. I want to create a new field with the server short name.