Description |
If event matches Condition convert IP address Expression and place the result into FieldName. |
|
|
Comments |
If either FieldName or Expression are blank, missing or invalid, the filter is disabled. |
<filter objectId="ipConvert" type="IPAddressToNumberConversionFilter"> <parameter type="Condition"> <negatePrimaryCondition>false</negatePrimaryCondition> <conditionRelation>Any</conditionRelation> <conditionSpec> <negate>false</negate> <fieldName>ev:ip</fieldName> <operator>containsString</operator> <valueType>string</valueType> <value>192</value> </conditionSpec> </parameter> <parameter type="Expression"> <type>String</type> <formatString>%1%</formatString> <formatParmSpec> <type>EventType</type> <name>ev:ip</name> </formatParmSpec> </parameter> <parameter type="FieldName">ev:ipNum</parameter> </filter>