Click HERE to see how Saviynt Intelligence is transforming the industry. |
04/29/2024 10:26 AM - edited 04/29/2024 12:41 PM
Hi Team,
I have requirements to correlate the account name only after the special character string. But correlation is not happening. Tried with multiple options but it didn't worked.
Account Name in Tager: AM\ABCD1234
Correlation Rules Tried: Case 1: upper(users.systemusername)=upper(accounts.name)#((users.systemusername)=SUBSTRING_INDEX(accounts.name, '\\', -1))
Case 2: upper(users.systemusername)=upper(accounts.name)#((users.systemusername)=SUBSTRING_INDEX(accounts.name, '\', -1))
Case 3: upper(users.systemusername)=upper(accounts.name)#((users.systemusername)=SUBSTRING_INDEX(accounts.name, "\\", -1))
Case 4: upper(users.systemusername)=upper(accounts.name)#((users.systemusername)=SUBSTRING_INDEX(accounts.name, "\", -1))
Case 5: upper(users.systemusername)=REPLACE(a.name, LEFT(a.name, CHARINDEX('\', a.name)), '')
Regards,
SJ_544
04/29/2024 02:43 PM
Hi @SJ_544 ,
Correlation rule is non-case sensitive, don't use 'UPPER'. Try below, its working for me:
users.systemusername=accounts.name # users.systemusername=SUBSTRING_INDEX(accounts.name,'\\', -1)
If you find the above response useful, Kindly Mark it as Accept As Solution and hit Kudos
04/29/2024 07:20 PM
Hi PremMahadikar,
Thanks for the response. Upper I am already using for other system correlation rules which is working fine.
04/29/2024 07:45 PM
If your issue resolved Please click the 'Accept As Solution' button on the reply (or replies) that best answered your original question.
04/29/2024 06:32 PM
Please share logs during job completion