Account Correlation Issue

[SJ_544]

Hi Team,

I have requirements to correlate the account name only after the special character string. But correlation is not happening. Tried with multiple options but it didn't worked.

Account Name in Tager: AM\ABCD1234

Correlation Rules Tried: Case 1: upper(users.systemusername)=upper(accounts.name)#((users.systemusername)=SUBSTRING_INDEX(accounts.name, '\\', -1))

Case 2: upper(users.systemusername)=upper(accounts.name)#((users.systemusername)=SUBSTRING_INDEX(accounts.name, '\', -1))

Case 3: upper(users.systemusername)=upper(accounts.name)#((users.systemusername)=SUBSTRING_INDEX(accounts.name, "\\", -1))

Case 4: upper(users.systemusername)=upper(accounts.name)#((users.systemusername)=SUBSTRING_INDEX(accounts.name, "\", -1))

Case 5: upper(users.systemusername)=REPLACE(a.name, LEFT(a.name, CHARINDEX('\', a.name)), '')

Regards,
SJ_544

[PremMahadikar]

Hi @SJ_544 ,

Correlation rule is non-case sensitive, don't use 'UPPER'. Try below, its working for me:

users.systemusername=accounts.name # users.systemusername=SUBSTRING_INDEX(accounts.name,'\\', -1)

If you find the above response useful, Kindly Mark it as Accept As Solution and hit Kudos

[SJ_544]

Hi PremMahadikar,

Thanks for the response. Upper I am already using for other system correlation rules which is working fine. 

[rushikeshvartak]

If your issue resolved Please click the 'Accept As Solution' button on the reply (or replies) that best answered your original question.

[rushikeshvartak]

Please share logs during job completion