Thanks Jeroen for your answer

i have tried the PARSE Function as below

DEF TYPE=SMF COMTYPE(CHAR,12)  AS WORD(RECORDDESC,2,' ')      
DEF TYPE=SMF UN(CHAR,20)  AS PARSE(RACFCMD,'NAME(',')')       
DEF TYPE=SMF CIVILID(CHAR,20)  AS PARSE(RACFCMD,'DATA(',')')  
DEF TYPE=SMF DEPT(CHAR,20)  AS PARSE(RACFCMD,'WADEPT(',')')   

alloc type=RACF primary active                                      
S type=(80,81,83) ((RELOCATE=6 OR EVENT=RACPRIV)) racfcmd=:ADDUSER  
 sortlist,                                                          
  recno(nd),                                                        

/ '   -Alert id        4007',                            
/ '   -Date and time'(18) date(9) time(11),              
/ '   -System ID'(18) system,                            
/ '   -Job name'(18) jobname,                            
/ '   -Result'(18) descriptor(0,explode),                                  
/ '  -ADMIN_ID'(18) user(8) ,                            
/ '  -ADMIN_NAME'(18) name,                              
/ '  -USER_ID'(18) racfcmd_user(8),                      
/ '  -USER_NAME'(18) UN(wrap,HOR,0),                     
/ '  -CIVILID'(18) CIVILID(wrap,HOR,0),                  
/ '  -DEPTARTMENT'(18,noretain) DEPT(wrap,HOR,0),        
/ '  -Action Needed '(18,noretain) COMTYPE ,      

it works fine and i got my data but the layout for the fields come from PARSE are shifted

   -Alert id        4007

   -Date and time  09Feb2023 09:18:55.77

   -System ID      bbbb

   -Job name       aaaaaaa

   -Result         Success

  -ADMIN_ID        cccccccc

  -ADMIN_NAME      bbbbbbbb

  -USER_ID         aaaaaaaa

  -USER_NAME             yyyyyyyyyyyyyyyy

  -CIVILID             xxxxxxxxxxxxxxxxx

  -DEPTARTMENT                               zzzzzzzzz

  -Action Needed   ADDUSER

if you have any idea about how to fix . thanks again for your support

The RACFCMD field is actually a repeated field, similar to the field CGGRPNM in the RACF USER profiles.  That means, for the command and each of the keywords, a separate entry (line) is prepared in the RACFCMD field.  You know this, because when you want to display or print the RACF command, you write RACFCMD(HOR,WRAP,0).  HOR means, print all the entries (lines) in one horizontal string.

Now, the PARSE( ) function processes each entry of the RACFCMD field separately.  If the entry does not match, PARSE leaves an EMPTY value, with length 0.  The HOR modifier that you used concatenates these empty values with a space (blank) in between.  So, if the NAME('programmer name') field is the 6th parameter in the command, your PARSE skips the RACF command and 5 other parameters, and HOR concatenates these with 6 spaces BEFORE the actual NAME value.

I hated this too when I was faced with the behavior of HOR and could find no work-around. Feel free to RFE a solution, my request fell on deaf (or, at least, over-committed) ears.

------------------------------
Rob van Hoboken
------------------------------

By the way, in your SELECT command

S type=(80,81,83) ((RELOCATE=6 OR EVENT=RACPRIV)) racfcmd=:ADDUSER  

it is easier and more efficient to use the EVENT field to select the command, like so 

S type=80 event=ADDUSER  

------------------------------
Rob van Hoboken
------------------------------

Hi Mohammed,

Rob correctly explained what is happening.

I can think of no way of putting the value without the preceding blanks onto the same line in a single pass.

You can get the value into a fixed position onto the line below by removing the (WRAP,HOR,0) and using ' '(18,NE) at the start of the next line.

(But you get stuck with many extra line breaks including empty lines in this way, so this might not help you much.)

Note: NOTEMPTY (or NE for short) does not work when you have a literal string other than blanks.

(And of course a two-pass solution is possible, but I don't think that is very useful in an Alert context.)

Regards,

   -Alert id        4007

   -Date and time  09Feb2023 09:18:55.77

   -System ID      bbbb

   -Job name       aaaaaaa

   -Result         Success

  -ADMIN_ID        cccccccc

  -ADMIN_NAME      bbbbbbbb

  -USER_ID         aaaaaaaa

  -USER_NAME             yyyyyyyyyyyyyyyy

  -CIVILID             xxxxxxxxxxxxxxxxx

  -DEPTARTMENT                               zzzzzzzzz

  -Action Needed   ADDUSER