Currently there's no way to extract the value of a match group from a regular expression in a vbvalue tag of an eventconf XML. We're increasingly getting requests for this functionality from customers. For example, F5 traps mostly lack a well-defined structure and need extraction from mid-value to get at the relevant portion of a resource name.
Here's an example varbind value from an actual F5 trap:
Node /Common/10.129.1.30 address 10.129.1.30 monitor status down. [ /Common/icmp_default: down ] [ was up for 0hr:1min:10sec ] (slot1)
In a better world, F5 would break up the various valuable bits of information into separate varbinds, but we don't live in that world. So I would like to be able to write an eventconf definition to pull that varbind apart. One way I imagine to do this is by using named-capturing groups in regex:
The result of this regex hitting would be the implicit creation of the following event parameters, in addition to the ones created by Trapd whose names are the numeric OIDs of the trap varbinds:
These parameters must be available in time for subsequent use in a <parameter> tag, e.g.:
<parameter name="whatToDo" value="Go find %nodelabel% and whack slot %parm[slotNum]% with a rubber mallet" expand="true" />