String Functions

String Functions	Description
Concatenate	Returns the string result of joining the two string arguments. For example, `Concatenate("Arc", "Sight")` returns `ArcSight`. When a rule using this function fires and your string values have beginning or trailing spaces, the spaces are dropped, even if the preview during function definition or export to XML displays the space. If you want to enforce a space, use ConcatenateThree (described next). Note: This function is held in memory, therefore you can only use it in Rules, Filters, and Data Monitors. You cannot use the function in resources like Queries and Reports, and other resources that rely on persisted data.
ConcatenateThree	Returns the string result of joining the three string arguments. For example, `Concatenate("ArcSight", "Command", "Center")` returns `ArcSightCommandCenter`. Note: This function is held in memory, therefore you can only use it in Rules, Filters, and Data Monitors. You cannot use the function in resources like Queries and Reports, and other resources that rely on persisted data.
EvaluateVelocityTemplate	For advanced users with thorough understanding of velocity templates. Evaluates the *velocity template* argument and returns the result. This function is not available in a Query or Active Channel, and Filters that use this function cannot be used in a Query or Active Channel. For information on how to use Velocity Templates in ESM, see Velocity Templates. Note: This function is held in memory, therefore you can only use it in Rules, Filters, and Data Monitors. You cannot use the function in resources like Queries and Reports, and other resources that rely on persisted data.
IndexOf	Returns the integer offset into the first string argument that is the location of the second string argument. For example, `IndexOf("Twas the night before Christmas", "night")` returns `9`. If the second string argument is not found in the first string argument, IndexOf returns `-1`.
LastIndexOf	Returns the index (position) of the last (rightmost) occurrence of the second argument (the substring) within the first string argument (the source). If the substring is not found in the source, the function returns `-1`. The first position is index `0`, as in the indexOf function. Examples: `lastIndexOf("abc/def/xyz, "/")` returns `7` `lastIndexOf("abc/def/xyz", "abc")` returns `0` `lastIndexOf("abc/def/xyz", "klm")` returns `-1`
LengthOf	Returns the number of characters in the string argument. For example, `LengthOf("Twas the night before Christmas")` returns `31`. `LengthOf("")` returns `0`.
Substring	Returns a portion of the first string argument, starting with the position specified in the second, numeric, argument and including the ending position as the sum of the number of characters and the starting position, specified in the third, numeric, argument. For example, `Substring("Twas the night", 5, 8)` returns "`the`".
ToLower	Returns the string argument converted to all lowercase. For example, `ToLower("Inline Filter")` returns "`inline filter`". Numbers and other non-alphabetic characters are not affected.
ToUpper	Returns the string argument converted to all uppercase. For example, `ToUpper("Inline Filter")` returns "`INLINE FILTER`". Numbers and other non-alphabetic characters are not affected.