EPL Advanced Rule

[Anonymous]

I am creating a simple rule with the below syntax, the rule was copied from a working basic rule and it is not firing as advanced rule, why???

@Description('')
@RSAAlert(oneInSeconds=0)

SELECT * FROM Event(
/* Statement: test */
(eth_src .toLowerCase() IN ('00:50:56:01:2F:F5'))

)

;

[LeeKirkpatrick]

Hi Bechara,

In the rule, the Java.Lang String Method .toLowerCase() has been used; this converts all metadata to lower case. Meaning that the MAC address you are looking for - 00:50:56:01:2F:F5 - needs to be in lower case - 00:50:56:01:2f:f5 - for this rule to work as expected.

Cheers,

Lee

[Anonymous]

thanks LEE, but the syntax is copied from a basic rule, with same syntax.