evtctxgetvar()

Returns the value of a user variable stored in an event context. Use this function to retrieve variables set by the evtctxsetvar() function.

Syntax

evtctxgetvar(TOPIC, KEY, VAR_NAME[, HOST])

Parameters

TOPIC
The topic name of the event context. String.
KEY
The key value of the event context. String.
VAR_NAME
The name of the variable to retrieve. String.
HOST
(Optional) The hostname to which the event context belongs. If omitted, the default host is searched.

Description

The function identifies the event context using TOPIC and KEY, then returns the value of the variable named VAR_NAME.

If TOPIC or KEY is null, null is returned. If the specified event context does not exist, null is returned. If VAR_NAME is null or no variable with that name exists, null is returned.

Error codes

Error codeDescription
invalid-evtctxgetvar-argumentsThe number of arguments is not 3 or 4.

Usage examples

  1. Query the client_ip variable of the event context matching the session key in the web_session topic

    evtctx topic=web_session key=session_id
| eval ip = evtctxgetvar("web_session", session_id, "client_ip")

  2. Set a variable with evtctxsetvar(), then retrieve it with evtctxgetvar()

    evtctx topic=login_fail key=src_user
| eval ok = evtctxsetvar("login_fail", src_user, "last_ip", src_ip)
| eval stored_ip = evtctxgetvar("login_fail", src_user, "last_ip")

  3. Query a variable that does not exist

    evtctx topic=login_fail key=src_user
| eval v = evtctxgetvar("login_fail", src_user, "no_such_var")
| # v: null

Compatibility

evtctxgetvar() has been available since before Sonar 4.0.