OIS - Link Properties, Published Data with Newline Characters, and Regular Expressions

  • Article

Hello readers/viewers! No video today, but I will be covering a fairly interesting topic. I realize that this may be an edge case, but I thought it would good to have something on the blog to reference for related topics.

SCENARIO:

  1. You have Published Data output which may contain newline characters ( \n).
    • NOTES:
      • In this case, the Published Data is not separated into multiple output data items.
      • You may experience this if you have flattened the Published Data with the Separate with line breaks option, or if you are referencing output from some objects where this data format is common (e.g. “Query WMI” object).
  2. You want to filter this Published Data by the existence of the newline character ( \n).
  3. You use the available Link Properties for string filtering, taking advantage of the matches pattern option.
  4. You notice that filtering the Published Data by matches pattern \n does not work as you expect.
    • NOTE: There is a “workaround” as well as a “working with /n character published data” section below.

EXAMPLE SCENARIO CONFIGURATION:
If we take something like the “Query WMI” object, which produces output with the new line character, and attempt to filter the “WMI Query Result as a string” by “Matches Pattern” \n in the link, it does not work:

image

image

image

EXAMPLE SCENARIO RESULTS:
During execution, this link filter configuration results in no data progressing past the link, even though the results look like this (where matching pattern would normally contain the \n):

image

POSSIBLE CAUSE:
I do not know the root cause for this behavior, but it may be that the Regular Expression implementation for Link Properties in OIS does not support “multiline mode” (search on this page for “multiline”).

MATCHES PATTERN DOES WORK:
I do know that “Match Pattern” in Link Properties Filtering does work, as I use it frequently to filter out “null” values from Published Data fields:

Usage for field “Is Null”:
image

Usage for field “Is Not Null”:
image

ALTERNATE REGEX TOOL RESULTS:
Now, if we take a portion of that same output and put it in an online .NET RegEx tester, you can see that the highlighted areas are where the \n character exists in the output sample (first 5 lines of the output from the Query WMI object).

image

NOTE: Lines copied from “Query WMI” object:

Caption=System Idle Process
Caption=System
Caption=smss.exe
Caption=csrss.exe
Caption=csrss.exe

WORKAROUND:
This does not mean that you are left with no ability filter based on the \n character; you simply have to use a workaround. The good news is, the workaround is pretty simple.

For those of you who do not yet know, there are a couple CodePlex releases which allow you to work with RegEx as a workaround:

If you would like to use Foundation Objects for the workaround, see the following steps:

Workaround Steps:

  1. Remove the link filter from the “Query WMI” object to the “Send Platform Event” object
  2. Insert a “Run .Net Script” object between those two objects (you will be doing the match in this object using PowerShell)
    image
  3. In the “Run .Net Script” object:
    • Choose the PowerShell Language Type
    • Use the following script (where the first variable takes in all the data from the output of the “Query WMI” object):
      image
    • Configure the Published Data tab like this:
      image
  4. Now add link filtering to the link after the “Run .Net Script” object:
    image

NOTE: PowerShell from the Details tab in this example (where $hasnewline will return “True” or “False”):

$inputdata = " {PUBLISHED DATA HERE} "
$hasnewline = $inputdata -match "\n"
$hasnewline

WORKING WITH \n CHARACTER IN PUBLISHED DATA:
Now that you can filter based on the \n character, you may want to know how to work with it.

Examples:
The following C# usage with the “Run .Net Script” object examples (OIS_EXPORT attached) parse the following output (from an example query WMI object):

clip_image002

  • Option 1: Just Parsing the “blob” of text into an array (where each new line is a new array element) – If you want to parse the “Name=” portion of the string in each array item, it will have to be parsed later in another object:

    string res = @"PUBLISHED DATA HERE"; string[] results = res.Split(new string[] {"\n", "\r\n"}, StringSplitOptions.RemoveEmptyEntries); foreach (string r in results) { lstResults.Add(r); }

    This results in multiple line output that still needs to be parsed (based on the desire to remove “Name=” from each array item):
    clip_image001

  • Option 2: Parse the “blob” of text into an array, then parse for specific data and output only what you want (no other objects required):

    string res = @"PUBLISHED DATA HERE"; string[] results = res.Split(new string[] {"\n", "\r\n"}, StringSplitOptions.RemoveEmptyEntries); foreach (string r in results) { string[] parsedResults = r.Split('='); lstResults.Add(parsedResults[1]); }

    This results in multiple line output that has already been parsed:
    clip_image001[5]

NOTE: For a more detailed video example of C# usage with the “Run .Net Script” object, please refer to the following post: https://blogs.technet.com/b/charlesjoy/archive/2010/07/14/8-minute-demo-net-scripting-object-c.aspx

enJOY!

Run_dotNet_Script_cSharp_Parse_Data_Examples.zip