EPL Advanced Rule
I am creating a simple rule with the below syntax, the rule was copied from a working basic rule and it is not firing as advanced rule, why???
SELECT * FROM Event(
/* Statement: test */
(eth_src .toLowerCase() IN ('00:50:56:01:2F:F5'))
In the rule, the Java.Lang String Method .toLowerCase() has been used; this converts all metadata to lower case. Meaning that the MAC address you are looking for - 00:50:56:01:2F:F5 - needs to be in lower case - 00:50:56:01:2f:f5 - for this rule to work as expected.