> "test": "substring(option[60].hex,0,6) == 'ArubaAP'", Assuming your configuration is correct, it could be that the substring is wrong being the only problem. ArubaAP is 7 characters and your substring is 0,6 as in start at position 0 and include the next 6 characters would only get ArubaA and so would not = ArubaAP