For version 11.2, RSA has added the ability to add log parsers and log parsing rules through the UI, using the Log Parsers view. The Log Parsers tab is populated based on your reference Log Decoder. If you have more than one Log Decoder, you can select which acts as the reference one for populating the tab in the UI. This topic describes the procedure to do so.
To change the reference log decoder:
- In the NetWitness Platform UI, navigate to Admin > Services.
- For the Content Server, select View > Explore.
- From the left navigation panel, expand content > parser.
To set the reference log decoder, enter a value for preferred-log-decoder-name-for-sync.
Enter the name listed in the Name column on the ADMIN > Services screen for your preferred log decoder.
The change takes effect during the next system sync, based on the log-decoder-sync-interval. To sync sooner, you can do either of the following:
- To sync immediately, restart the Content Sever: in the ADMIN > Services view, from the Actions menu for the Content Server, select > Restart.
- Change the log-decoder-sync-interval parameter from its default of 12 hours to your preferred interval. Note that the minimum value for this parameter is 1 HOUR.