How to escape the double-quote character in Sentinel Active View Filter

  • Document ID:7003589
  • Creation Date:19-Jun-2009
  • Modified Date:26-Apr-2012
    • Micro Focus Products:
      Sentinel

Environment

Novell Sentinel 6.1 Sentinel Control Center

Situation

An Active View is required that should filter on text in the "Message" property which contains a double-quote (") character. Entering this character to the filter directly will produce an error:

Error: SEN-13001 Invalid syntax at line x, column y: expecting RPAREN, found 'z'

Resolution

Special characters, like double-quotes need to be escaped and its character code needs to be used. In case of double quote \x22 can be used.

Example for a log entry:

Jun 17 10:57:22 172.16.0.53 host process: Wed Jun 17 10:57:22 2009 [pid 1234 ]CONNECT: Client"192.168.1.1"

The following filter can be used to create an Active View:

filter( e.Message match regex("Client \x22") )