|Resolution||The contents of a custom feed can be viewed using the shell console on the Log Decoder appliance, following the steps below.|
To view meta keys involved in custom feeds, follow the below steps.
- Connect to the Log Decoder using SSH as the root user.
- Go to the directory where the feeds are stored.
- Use the NwConsole utility to dump the custom feed contents.
Note: Each time output file name should be different when running NwConsole command.
NwConsole -c feed dump <feed_file_name> <output_file_name>
- Use the cat command to display the contents of the feed.
- Go to feeds directory using cd /etc/netwitness/ng/feeds
- Run NwConsole -c feed stats <feedname> to view meta key details for this feed.
[root@Dec feeds]# NwConsole -c feed stats FINUsersFeedSrc.feed
RSA NetWitness NextGen Console 220.127.116.11
Copyright 2001-2018, RSA Security Inc. All Rights Reserved.
>feed stats MyUsersFeedSrc.feed
version : 0
keys count : 1
values count: 1
record count: 205
meta key : user.src
More details on this command see NwConsole Useful Commands
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.