My message looks like:


Code:
--------------------
{"gid":"UserApp#UserStartWorkflow#f81af505-92a5-4b80-9f08-686c7662b388","Data":"IN:Cikara, Craig (3810925)|INF:3810925|AL:centralLevel|TU:Smit, Dawid (3567257)|TUF:3567257|IC:Central-Admin:*:*:*|ICCC:*|ICCoC:*|ICBU:*|AU:N\/A|AR:N\/A|TA:N\/A|AS:Processing|WNisable User Account|TR:Fri Apr 05 13:29:04 SAST 2013|CI:UserApp#UserStartWorkflow#f81af505-92a5-4b80-9f08-686c7662b388|"}
--------------------


So in the collector's custom.js file I have:


Code:
--------------------
Record.prototype.customParse = function(e) {
if (this.RXMap.S == "workflow_log" && this.RXMap.B != "System"){
log("workflow_log");
var jsonObj = JSON.parse(this.RXMap.D);
var workflowDetails = jsonObj.Data.parseNVP("|", ":");
e.CustomerVar23 = workflowDetails.IN;
}
return true;
}
--------------------


And this works...

But now I want to somehow add an external mapping file that would map
the parsed message field value to the Sentinel event field.

I added the following lines to a file "customR2E.map" and added that to
the collector:


Code:
--------------------
CustomerVar21,workflowDetails.IN
CustomerVar22,workflowDetails.INF
--------------------


Then in the Collector.prototype.customInit function in the custom.js
file I added:


Code:
--------------------
Collector.prototype.customInit = function() {
// load additional maps, parameters, etc
this.MAPS.Rec2Evt.extend(this.CONFIG.collDir + "/customR2E.map")
return true;
}
--------------------



Now... I though that doing what I did above, I would not need to now
specify what values of my workflowDetails object need to go to what
Sentinel fields... I thought that extending the Rec2Evt map with
customR2E.map would handle that?


Any suggestions where I am going wrong?

The output I see when doing the above in sentinel is just a whole bunch
of NULL events...

Regards,
Craig Cikara


--
ccikara
------------------------------------------------------------------------
ccikara's Profile: https://forums.netiq.com/member.php?userid=506
View this thread: https://forums.netiq.com/showthread.php?t=47475