Conditional Stmt - Not working on Formula Field 1

[epoh]

I am still working on this project (

http://www.tek-tips.com/viewthread.cfm?qid=1482865&page=1)

This is the row {Table1.Field4} I was trying to parse earlier and separate each field (Thanks to lbass I was able to get it)

Formula Field: @PIX_Code

Right(Left({Table1.Field4},13),12)

Now I am trying to make a conditional statement for each PIX code, however when I do:

IF {@PIX_Code} = "PIX-3-71003" Then
"It worked..."
Else {@PIX_Code} & " <-- This has not been added to stmt"

Every record shows the Table1.Field4 & " <-- This has not been added to stmt"

i.e. even on the records that are PIX-3-71003 it still goes to Else

-----
At first I thought the percent was acting as a boolean and messing it up but after doing the Right (12) of the Left (13) it still did it.

I am confused.

Thanks

 

[bdreed35]

Not sure if this is the issue, but {@PIX_Code} is built to return 12 characters, but you are trying to compare it to a string that only has 11 characters.

~Brian

 

[lbass]

You could just use:

if extractstring({table1.field4},"%",":")= "PIX-3-710003" then
"It worked..." Else
extractstring({table1.field4},"%",":") & " <-- This has not been added to stmt"

I wonder why you are setting up individual formulas like this.

-LB

 

[epoh]

Because I thought it was the best method, if there is something better I am open to that.

Thanks

 

[epoh]

I was planning on a Case Select for each PIX Code. But again I am open for a better method.

 

[lbass]

We don't know why you are doing it though. We would need more explanation of the purpose.

-LB

 

[epoh]

Several of the PIX Codes have a different layout.

I am wanting to format each of those codes so they make sense in a report.

(My plan was to use a Select Case statement to make this easier. )

I thought that I would add formatting for each code as they came up.

 

[lbass]

Sorry, that isn't enough information to be able to help.

-LB

 

[epoh]

As you will notice in the other post [

http://www.tek-tips.com/viewthread.cfm?qid=1482865&page=1

]

There are multiple message types that will be logged and in different formats (i.e. what is the IP Address in one row, is not the IP Address in another row: instead it is text or it could be a port)

I had planned on using a Select Cast statement to (for each PIX-Code) sort the data

If Table1.Field4 = Pix-1-001 format it like this
If Table1.Field4 = Pix-1-002 format it like this
If Table1.Field4 = Pix-1-003 format it like this

etc.

Until I had formatted all of the codes so they made sense to the person reading the report.

If there is a better way to do this (than using an IF or Select Case statement) that would be great.

But off hand I couldn't think of a better way.

 

[lbass]

Sorry, I don't see it. You should probably just proceed as planned.

-LB

 

[epoh]

I understand.

I have tried moving along with the Select Case (now I'm working an If statement b/c the Select Case didn't work)

If {Table1.PIX} = "PIX-3-71003" Then
        stringvar x := replace(replace(replace(replace(replace (replace(replace(replace({Table1.Msg}, chr(13),"^"),"(","^"),":","^"),")","^"),"/","^"),"from ","from ^")," to","^ to"),"^^","^");
        stringvar array y := split(x,"^");
        join(y,"|");

        stringvar x := replace(replace(replace(replace(replace (replace(replace(replace({Table1.Msg}, chr(13),"^"),"(","^"),":","^"),")","^"),"/","^"),"from ","from ^")," to","^ to"),"^^","^");
        stringvar array y := split(x,"^");
        if ubound(y) >= 3 then
        y[3]

    Else
        "Not documented"

And it does not work, it is as if it is skipping the entire If statement and processing this

        stringvar x := replace(replace(replace(replace(replace (replace(replace(replace({Table1.Msg}, chr(13),"^"),"(","^"),":","^"),")","^"),"/","^"),"from ","from ^")," to","^ to"),"^^","^");
        stringvar array y := split(x,"^");
        join(y,"|");

        stringvar x := replace(replace(replace(replace(replace (replace(replace(replace({Table1.Msg}, chr(13),"^"),"(","^"),":","^"),")","^"),"/","^"),"from ","from ^")," to","^ to"),"^^","^");
        stringvar array y := split(x,"^");
        if ubound(y) >= 3 then
        y[3]

Because it doesnt matter what I put in as my first value to check against Table1.PIX (even if it is garbage) it totally disregards the if statement

 

[lbass]

You don't need the join formula at all. Create one master formula to also use for y1:

//{@y1}:
stringvar x := replace(replace(replace(replace(replace (replace(replace(replace({Table1.Msg}, chr(13),"^"),"(","^"),":","^"),")","^"),"/","^"),"from ","from ^")," to","^ to"),"^^","^");
stringvar array y := split(x,"^");
trim(y[1])

//{@y2}:
evaluateafter ({@y1});
stringvar array y;
if ubound >= 2 then
trim(y[2])

//{@y3}:
evaluateafter ({@y1});
stringvar array y;
if ubound >= 3 then
trim(y[3])

//etc.

But I don't see what this has to do with the conditional formula. All you seem to want is y1, but with the % removed. So try something like this:

select extractstring({table.field},"%",":")
case "PIX-3-71003" : "It worked"
case "PIX-4-71005" : "Didn't work"
default : "Who knows?"

-LB

 

[epoh]

Well I want more than the % removed. I want the text ":", "(", ")", "|" into separate columns.

Depending on the PIX Code, the data will be in different places.

Like I said earlier, the source IP Address won't always be in the 3rd position in Table1.Msg, it may be in the 4th or 7th position.

 

[lbass]

What data will be in different places? You already have the formulas to create multiple separate fields. You are testing the PIX code to return something, but you are being very unclear on what that is. So please show sample data and then show the same data returned as you would like to see it in your report. Earlier you seemed to be saying you needed to create a custom comment per PIX code. Now you seem to be saying that depending upon the PIX code, you want to display some other "field" within the same original field. If this is the case, what is it? I personally don't know how to distinguish an IP address from a port address or whatever it's called.

-LB

 

[epoh]

Ok here is some sample data and you will see why I was wanting to format the data differently based on the PIX Code

Example: PIX-3-710003

%PIX-3-710003: TCP access denied by ACL from 72.14.205.103(unresolved)/50186 to outside:64.14.112.16(unresolved)/22

Example: PIX-4-313005 (notice there is a colon after message)

%PIX-4-313005: No matching connection for ICMP error message: icmp src inside:192.168.1.3(unresolved) dst outside:72.14.205.103(unresolved) (type 3, code 10) on inside interface.  Original IP payload: tcp src 72.14.205.103(unresolved)/80 dst 192.168.1.3

The "columns" made in the stringvar now off, because of the colon after the word message and after the word payload

Thanks (I hope this help)

 

[lbass]

This makes no sense to me, as I don't know what you want to extract. What is it you want to see for the above two examples?

-LB

 

[epoh]

Sorry for not being clear.

Actual message:

%PIX-3-710003: TCP access denied by ACL from 72.14.205.103(unresolved.name.com)/50186 to outside:64.14.112.16(my.host.com)/22

Desired output (parsed):

PIX-CODE=PIX-3-710003
MSG1=TCP access denied by ACL from
IP1=72.14.205.103
DNSLU1=unresolved.name.com
PORT1=50186
MSG2=to outside
IP2=64.14.112.16
DNSLU2=my.host.com
PORT2=22

--------------------------------PROBLEM PIX-CODE----------------
Actual message:

%PIX-4-313005: No matching connection for ICMP error message: icmp src inside:192.168.1.3(unresolved) dst outside:72.14.205.103(unresolved) (type 3, code 10) on inside interface.  Original IP payload: tcp src 72.14.205.103(unresolved)/80 dst 192.168.1.3

Output:

PIX-CODE=PIX-4-313005
MSG1=No matching connection for ICMP error message: icmp src inside:192.168.1.3(unresolved) dst outside
IP1=72.14.205.103
DNSLU1=unresolved.name.com
MSG2=(type 3, code 10) on inside interface.  Original IP payload: tcp src
IP2=72.14.205.103
DNSLU2=unresolved.name.com
PORT2=80
SKIP_THIS_TEXT=dst 
IP3=192.168.1.3

I hope that helps you see what I am looking for. And why I thought that I would have to check each code so I could sort each code differently based on what the data in the code means and where it goes

Thanks (and thanks for your patience)

 

[lbass]

Sorry, I think this is too complex (for me) to code. It almost becomes a manual process. If you need to work with this data the way you say, then the data needs to be organized with consistent delimiters.

-LB

 

[epoh]

Good point, I noticed that as I started separating that there were no consistent delimiters.

I will check some other options out.

Thank your for your help.

I appreciate it

 

[epoh]

Doesn't this make the case for processing each code differently?

If 4-313005 is the only one that there is a problem why can't I just leave it in its original format and only apply the formatting to the other messages that you provided a solution for?