Modify the delimiter when a variable in the Log to Syslog response rule returns two or more values
search cancel

Modify the delimiter when a variable in the Log to Syslog response rule returns two or more values

book

Article ID: 389950

calendar_today

Updated On: 03-05-2025

Products

Data Loss Prevention Core Package Data Loss Prevention

Issue/Introduction

Currently, when using the Log to Syslog response rule, if a variable returns two or more values, the delimiter is a space.
Can that delimiter be modified to be a comma or semicolon.

In particular, the request is to modify the delimiter in the $File_Name$ and $Attachment_FileName$ variables.
But it would be nice to be able to modify the delimiter for all the variables.

Example:
Current: For the File Name variable: 
This is a test file.txt This is a test file2.txt  (Note the space between the filenames.)

What is wanted:
This is a test file.txt,This is a test file2.txt  (Comma between the filenames.)

Cause

Your reporting software looks for a comma or semicolon to separate the values.
The space delimiter is not a valid separator for the reporting software.
The space is just considered a space between words in one value.

Resolution

A feature request, ISFR-3625, has been submitted to be able to modify the delimiter.
If you want to be added to this request, open a case and provide this KB number.