Related Documentation
Creating a Calculation-based Custom Property
You can create a calculation-based customer property to match payloads to a regular expression.
When you configure a calculation-based custom property, the Custom Event Propertyor Custom Flow Property windows provide the parameters listed in table 1:
Table 1: Custom Property Definition Window Parameters (calculation)
Parameter | Description |
|---|---|
Property Definition | |
Property Name | Type a unique name for this custom property. The new property name cannot be the name of a normalized property, such as Username, Source IP, or Destination IP. Note: The following characters cause an error if they are used in creating a new property name: Backslash ( \ ), comma (,), period (.), ampersand (&), single quotation mark ( ' ), double quotation mark ( " ), parentheses (()), and double brackets ([]). Note: For CEPs and CFPs that include the denoted characters, you need to create a duplicate of the property and save the new property name without using the denoted characters. Then, change all of the dependents of the old property to reference the new property. Finally, delete the old property. |
Description | Type a description of this custom property. |
Property Calculation Definition | |
Property 1 | From the list box, select the first property that you want to use in your calculation. Options include all numeric normalized and numeric custom properties. You can also specify a specific numeric value. From the Property 1 list box, select the User Defined option. The Numeric Property parameter is displayed. Type a specific numeric value. |
Operator | From the list box, select the operator that you want to apply to the selected properties in the calculation. Options include:
|
Property 2 | From the list box, select the second property that you want to use in your calculation. Options include all numeric normalized and numeric custom properties. You can also specify a specific numeric value. From the Property 1 list box, select the User Defined option. The Numeric Property parameter is displayed. Type a specific numeric value. |
Enabled | Select this check box to enable this custom property. If you clear the check box, this custom property does not display in event or flow search filters or column lists and the event or flow property is not parsed from payloads. If you clear the check box, this custom property does not display in event search filters or column lists and the event or flow property is not parsed from payloads. |
- Choose one of the following: Click the Log Activity tab.
- Optional. If you are viewing events or flows in streaming mode, click the Pause icon to pause streaming.
- Double-click the event that you want to base the custom property on.
- Click Extract Property.
- In the Property Type Selection pane, select the Calculation Based option.
- Configure the custom property parameters.
- Click Test to test the regular expression against the payload.
- Click Save.
The custom property is now displayed as an option in the list of available columns on the search page. To include a custom property in an events or flows list, you must select the custom property from the list of available columns when you are creating a search.
