Answer by Mike Hardesty (342) | Oct 04, 2016 at 02:38 PM
The Format string is a combination of regex capture groups and delimiters. For example, you might want to parse an IP address and port to combine them both into a string. If your regular expression had two capture groups, the format string you use to combine them might look something like this: $1:$2.
You will more than likely just want to use $1 for capture group 1.
Copied from documentation.
Answer by mattp2 (16) | Feb 13, 2017 at 06:38 PM
In my experience, the format string field is also kinda weird because a capture on a digit expects you to enter just the number of the capture group in the UI, e.g. 1, where a capture group on a string value expects you to enter the format string as $1.
Announcement: QVM Externally Hosted Scans (March 1st - power outtage) 0 Answers
Qradar DSM Editor - add EventID values 1 Answer
DSM Editor - Max Regular Expressions 5 Answers
DSM Editor and Mapping Events - Not working 3 Answers
I am pleased to see the new DSM editor but it isn't terribly intuitive. 4 Answers