Hi Joe, Rob,
First of all, I want to point out that we document for EVENTDESC that the contents is subject to change, so I am not fond of recommending parsing of the contents.
The solution where you select on EVENT(EVENTQUAL) and then use your own string and MERGELIST, seems better to me.
The DEFINE .. PARSE in TYPE=SMF results in a CKR0467 syntax error, that this is not allowed with the EventDesc format.
So if you want to do that, you need to do it in a post-processing pass where you read it in as a string (ASIS) from a DEFTYPE file.
But indeed, something like WORD(PARSE(eventdesc,':'),')') might extract the part you want.
Internally EVENTQUAL is a binary field, but if you put the field on SORTLIST, you get a decimal number rendered in EBCDIC, not a binary one, on output.
Regards,
------------------------------
Jeroen Tiggelman
IBM - Software Development Manager IBM Security zSecure Suite
Delft
------------------------------
Original Message:
Sent: Fri June 07, 2024 02:58 AM
From: Rob van Hoboken
Subject: substr - eventdesc not working
The EVENTQUAL field contains the numerical event qualifier, but it is only available for output processing, so not for SELECT.
I suppose you could print this value and replace it with your favorite text string in another (post-processing) jobstep.
You could split up the SMF record processing in as many separate newlists as you want different event qualifier strings, using the EVENT field for selection:
newlist type=smf name=r80_1_1
select event=RACINIT(1)
sortlist ........ "Invalid password"
newlist type=smf name=r80_1_2
select event=RACINIT(2)
sortlist ........ "not in group"
newlist type=smf name=r80_1_rest
select event=RACINIT
exclude likelist=R80_1_1 or R80_1_2
sortlist .... eventdesc
Even write MERGELIST/ENDMERGE around these separate newlists to get the output in sorted order.
You may experiment with using a deftype lookup based on EVENTQUAL, though be mindful that this is a binary field, so the key part of your external file also needs the binary representation of the eventqual number.
You can also experiment with (not at all sure it would be allowed):
define qual_explained as parse(eventdesc,":")
------------------------------
Rob van Hoboken
------------------------------