EMS Manual

Compiled Filters
EMS Manual—426909-005
5-14
Tokens
Fields
A field name refers to a simple subcomponent (containing an integer, for example) of a
structured token within the event message. In a comparison, the field name represents
the value of the subcomponent or of an array of subcomponents.
The syntax to refer to a field:
token-name
is the name of a structured token. That is, token-name is the name of a TACL
variable that contains the token map or token code for the structured token. You
can qualify the token name and include an index. For details, see Tokens
(Unqualified) on page 5-11 and Qualified Tokens on page 5-12.
struct-name
is the name of a TACL variable of type STRUCT that presents the structure of
token-name.
field-name
is the name of a field or substructure within the structure.
index
is an integer that specifies one element of an array of fields. If you omit both
index and range, index is zero.
range
is a pair of indexes (integers) separated by a colon; 2 : 4, for example. This
notation represents an array of fields, which includes the field at the first index
through the field at the second index.
Considerations

The field syntax is that used in TACL.

The TACL variable token-name sometimes contains a token code rather than a
token map. A token code is appropriate if the token (ZSPI^TKN^ERROR, for
example) is a structured token but not an extensible structured token.
token-name.struct-name [ : field-name [ ( index ) ] ] ...
[ : field-name [ ( index ) ] ]
[ ( range ) ]