computedValue element

The <computedValue> element contains an expression that runs when the rule receives an event to create a string value that is based on the value of one or more attributes of the event. This string value can then be used in the grouping key.

Details

Sometimes, a rule writer might want to use items such as these in the grouping key:
  • A substring of an event attribute value. For example, if an event attribute value contains an embedded IP address, the expression within the <computedValue> element could extract that IP address as a unique value to use in the grouping key.
  • Substrings of the values from several different event attributes. For example, the expression within the <computedValue> element could extract the substrings and combine them to create a unique value to use in the grouping key.

If the expression within the <computedValue> element returns a null value, the rule treats this null value as a missing attribute value.

Refer to Variables for information about the variables that can be used in expressions. The use of certain variables is dependent on the context of the expression.

Attributes

<computedValue> has the following attribute:

Table 1. Attributes of the <computedValue> element
Name Description Data type Required?
expressionLanguage Identifies the programming language in which the expression is written. Because the Java™ programming language is the only supported expression language, the only valid value for this attribute is java. xsd:NMTOKEN Yes

Contained within

<computedValue> is contained within the following element:

Contains

<computedValue> contains no elements.

Related concepts
Expressions