Relevance to concatenate multiple lines from an Event ID message field

Content Authoring
1

I have the following client relevance statement, but I am missing something in the formatting. The “it” at the end of the second string search in () is associated with the event filter, but the “it” in the first () string search is not. What am I missing?

( preceding texts of firsts "%0d%0a" of following texts of firsts "P1:" of it ) & " | " & ( preceding texts of firsts "%0d%0a" of following texts of firsts "P4:" of it ) of unique values of descriptions whose (it contains "APPCRASH") of records whose ( event id of it =1001 ) of event log "Application"

Thanks for all the help so far,
Emil

2

The second “it” is pointing to the object only because it immediately precedes the object. If you enclose the entire construct in a set of parentheses, the relevance engine will associate both of them with the proper object:

(( preceding texts of firsts "%0d%0a" of following texts of firsts "P1:" of it ) & " | " & ( preceding texts of firsts "%0d%0a" of following texts of firsts "P4:" of it )) of unique values of descriptions whose (it contains "APPCRASH") of records whose ( event id of it =1001 ) of event log "Application"
1 Like
3

I tried that already built ran the code you provided to double-check; still no joy.

Q: (( preceding texts of firsts "%0d%0a" of following texts of firsts "P1:" of it ) & " | " & ( preceding texts of firsts "%0d%0a" of following texts of firsts "P4:" of it )) of unique values of descriptions whose (it contains "APPCRASH") of records whose ( event id of it =1001 ) of event log "Application"
E: A singular expression is required.

Thoughts?

4

That’s a different issue. To use concatenation, you need to create a singular string from each pass through the appcrash event log entries.

(( preceding text of first "%0d%0a" of following text of first "P1:" of it ) & " | " & ( preceding text of first "%0d%0a" of following texts of first "P4:" of it )) of unique values of descriptions whose (it contains "APPCRASH") of records whose ( event id of it =1001 ) of event log "Application"
1 Like
5

Thanks. I understand now.
Emil

6

I have this code working a treat, but I would like to improve its aesthetics.

Q: If Windows of Operating System then ( multiplicity of it as string, it ) of ( unique values of  ( ( preceding text of first "%0d%0a" of following text of first "P1: " of it ) & " | " & ( preceding text of first "%0d%0a" of following text of first "P4: " of it )) of ( description of it ) whose ( it contains "APPCRASH" ) of records whose ( time generated of it > now - 365 * day and event id of it = 1001 ) of event log "Application" ) as string Else "Not Windows"
A: 1, cmd.exe | StackHash_d6c2
A: 10, cscript.exe | StackHash_d6c2
A: 100, svchost.exe_wuauserv | combase.dll

I would like the output look as follows:
1x | cmd.exe | StackHash_d6c2
10x | cscript.exe | StackHash_d6c2
100x | svchost.exe_wuauserv | combase.dll

I tried adding
concatenation "x | " ( multiplicity of it as string, it ) of… with no luck

I’m sure it’a simple fix but it eludes me.

Cheers,

Emil

7

This should work

... ( multiplicity of it as string & "x", it) ...
8

That works to get me the “x” after the multiplicity digits, but I also want to replace the default “,” delimiter the with “|” the the output looks as follows:

1x | cmd.exe | StackHash_d6c2

rather than the default, using your suggestion above:

1x, cmd.exe | StackHash_d6c2

Thoughts?

9

Ah - I didn’t look closely enough. You’ll need to concatenate the two items of the tuple, incorporating the required separator in the concatenation:

(item 0 of it & “x | “ & item 1 of it) of (multiplicity of it as string, it) of …

2 Likes
10

That worked. Problem solved. Thanks

–

Emil

2 Likes