datasource.dtd extension

The file datasource.dtd was extended for defining the data format transformation.

<!ENTITY % description.dtd SYSTEM "_description.dtd">

%description.dtd;

<!--

       attribute transformations

-->

<!ENTITY % attributetransformation.dtd SYSTEM "_attributetransformation.dtd">

%attributetransformation.dtd;

<!ELEMENT realmtable (sourcetable?, realmvaluetransformations?)>

…                              

<!ELEMENT realmvaluetransformations (realmvaluetransformation+)>

<!ELEMENT realmvaluetransformation (eventattribute, transformation)>

<!ELEMENT eventattribute (#PCDATA)>

New DTD _attributetransformation.dtd

<!ELEMENT transformation EMPTY>

<!ATTLIST transformation

       type NMTOKEN "timestamp"

       format CDATA #REQUIRED

>

For an analysis realm data source, the transformation of the data format can be defined using the XML element realmvaluetransformations. At least one realmvaluetransformation element must be defined, comprising the elements eventattributetype and transformation.

The eventattributetype element contains the type of the attribute in the XML source event, file to which the transformation belongs.

The transformation rule consists of the transformation type (default: timestamp because this is transferred from the file eventmapping.dtd). For each event attribute type, only the realmvaluetransformation element can be defined.

The format element defines the format to be used for transformation.