Article Content
Article Number | 000038309 |
Applies To | RSA Product Set: RSA NetWitness Platform RSA Version/Condition: 11.3.x, 11.4.x |
Issue | Whenever the customers create an ESA Rule using the Rule Builder or Advanced EPL with the index.toLowerCase they receive a syntax error; For example, the below sample rule generates an Error - Syntax error in module. Incorrect syntax Sample Rule -
Error -
Index is listed as a string in the meta key definitions. The main reason for this behavior is that index is a keyword in EPL, so it cannot be used as a meta parsed in lowercase. |
Resolution | A workaround is available for RSA NetWitness Platform version 11.3.x onwards, If a customer wants to use index meta with lowercase functionality they can declare 'index' meta under 'lowercase' field in the Correlation Server Explore view and use 'index_lower' in the ESA rule which will have a lowercase value of index meta. It is always recommended to identify the meta that needs lowercase functionality and add it under lowercase field to improve the performance. Steps to add index meta to lowercase -
Then edit the ESA rule and use 'index_lower' instead if 'index' as the meta key. An ESA Rule with the above workaround will be shown as -
|