Event Rule to identify a NULL value in an event variable via REGEX

Products

• Network Observability
• Spectrum

Issue/Introduction

How to evaluate if an event variable value is NULL (empty).

Environment

Spectrum: Any Release

Resolution

a) In the Event Configuration Editor, select the desired event code to create an Event Condition in the Event Rules tab:

b) Click on the " + " button to create an Event Condition rule:

c) Select the following to create the Event Rule:

• Criterion Left Operand
  • Event Variable Type: Event Attribute
  • Value: 0
• Operator
  • Regular Expression
• Criterion Right Operand
  • Event Variable Type: String
  • Value: ^(?!\s*$).+

Click on the "Insert Criterion" button.

d) Select the desired Generate Event, ensure Copy All Event Variables is selected, and click on the OK button:

e) Click on the " + " button to create another Event Condition rule:

f) Select the following to create the default Event Rule:

• Operator
  • Default

Click on the "Insert Criterion" button.

g) Select the desired Generate Event, ensure Copy All Event Variables is selected, and click on the OK button:

h) Click on the OK button:

i) Click on the Save button to save the Event Rule:

j) These are the entries in the custom EventDisp file:

cat $SPECROOT/custom/Events/EventDisp
0xfff00000 E 0 R CA.EventCondition, "(regexp({v 0}, {S \"^(?!\s*$).+\"}))" , "0xfff00001  -:-","default" , "0xfff00002  -:-"
0xfff00002 E 0
0xfff00001 E 0

h) Run the following in the CLI (Command Line Interface) to validate the Event Rule logged as Spectrum Install Owner account:

cd $SPECROOT/vnmsh/

./connect

./create event type=0xfff00000 text="" mh=0x100006d

./create event type=0xfff00000 text= mh=0x100006d

Where 0x100006d is the model_handle of the target device where the event will be generated.

Spectrum generated the 0xfff00002 event because the value of variable 0 is NULL:

Run the following in CLI:

./create event type=0xfff00000 text="Test Message" mh=0x100006d

./create event type=0xfff00000 text=" " mh=0x100006d      (blank space)

Spectrum generated the 0xfff00001 event because the value of variable 0 is NOT NULL: