DX Unified Infrastructure Management

I am attempting to build a pre-processing rule that would suppress/exclude any alarm that does not have User Tag 1 populated. My testing seems to indicate that this may not be possible as it appears that if nothing is populated in that field - my regex is not applied.

In my case the User Tag 1 field can be poplulated with one of three stings or left blank - I want to suppress any alarms that User Tag 1 is blank. I tried building a regex that if not /^(?!oneofmystrings)/ suppress. This does not appear to work as the blank alarms are still getting thru to the alarm console.  I don't know how I would build a "isnull" regex or if this is even possible? 

Has anyone ever run into something like this or have any suggestions?

This should be the right regex for an empty field:

/^$/

I believe the attached screenshot "proves" that blank fields are not being evaluated in the NAS. The pre-processing rule was activated at 11:40 and you can see that alarms that have come in after that do not have User Tag 1 popluated. I agree with Craig - lua may be the way.

Looks like a bug in the NAS.

Assuming you do not want to wait for a fix (or maybe do not want to bother opening a case), custom pre-processing (Lua) should be able to do this. Something like this:

if event.user_tag1 == nil then
   return nil
end

return event

 This assumes that the user_tag1 field is nil when there is no user tag set. You will have to test to be sure. The other possibility is an empty string (""), but I think nil is more likely.

...or I am afraid off the new issues that would be introduced in the fix. 

Also, just a thought, what if you put anything in User Tag 1: /.*/

and then hit the grey box so it turns red, so it is a NOT statement.

Basically saying NOT Anything?

The Lua script Keith came up with looks like it will work as well, but I am just wondering if this simple fix would work as well?

So this was user error on my part with regards to when I was executing the action - both Kieth's and Steven suggestions worked. Thank you

If it turns out the regex won't apply to empty fields, you may be able to write a lua script to replicate the behavior you are looking for. You could have a preprocessing rule run the script against all incoming alarms and it could check the value of User Tag1, then handle the alarm accordingly. I haven't tried this, but it seems like it should work.