Replacement Syntax

A core concept is replacement syntax that enables simple data reference and manipulation. An easy way to think about replacement syntax is to think back to the old days of Microsoft Word and its feature mail merge that enables an external data source to be used to insert into certain parts of the file.

Replacement syntax is defined by starting and ending with %%:

%%data[event][hostname]%%

%%eventData[integration][system][extracts]%%

%%var[local][hostname]%%

Anywhere that supports replacement syntax will allow any number of defined %% along with plain text:

My hostname is %%data[event][hostname]%% and my domain is %%var[event][domain]%%

After replacement syntax has taken place the resulting value is type casted automatically meaning that A-Ops will detect and convert the type of data provided. For example if the event data contains a field called percent and it is a number e.g. '2' then this would become a normal integer with the value of 2.

Function Support

In addition to referencing data values replacement syntax supports extendable functionality using functions that can be provided by integrations.

%%length(data[event][hosts])%%

You can even nest functions within functions:

%%intToStr(length(var[local][hosts]))%%

Read more about functions