I've gotten the script to work how I wanted by removing the identify and just targeting a specific syslog message and its outputting exactly how i want it now. I have a follow up though. When it runs and it exports to our syslog server, I get the cli output as expected, but I also get a second line of just hostname#. How can I remove it from sending the second line and just the exact cli output
This is the script:
event manager applet SHOW_MAC_VLAN authorization bypass
event syslog pattern "%SESSION_MGR-5-SUCCESS:"
action 1 regexp "([a-f0-9]+\.[a-f0-9]+\.[a-f0-9]+)" "$_syslog_msg" match mac
action 2 cli command "enable"
action 3 cli command "show mac address-table | in $mac"
action 4 syslog msg "$_cli_result"
The syslog message looks like this
004851: Oct 29 15:35:51.779: %SESSION_MGR-5-SUCCESS: Switch 1 R0/0: sessmgrd: Authorization succeeded for client (<MAC Address>) on Interface GigabitEthernet1/0/41 AuditSessionID E4BF090A00000037D9C6C7C8
004852: Oct 29 15:35:52.339: %HA_EM-6-LOG: SHOW_MAC_VLAN: <VLAN> <MAC Address> STATIC Gi1/0/41
switch-1#
004853: Oct 29 15:35:56.003: <next syslog output>
How can I remove the switch-1# on the 3rd line?