How can we include a metakey for storage on the Archiver? I see the device.host is not included. Unable to generate historical reports on this metakey.
Also, when we query the Archiver for session size (in bytes), it shows us the total session size stored for the metakey before compression, right?
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
- rsa sa
- security analyitcs
On the archiver config page you will see a ‘meta’ section. This will show you all the keys being sent to the archiver.
In the explorer page under the device config you will see a ‘meta include=‘ statement. This is where you would add additional keys to be brought over to the archiver. If you want to report on those keys, you would also need to add them into the index-archiver-custom file
Refer below article to add additional meta key's to archivers
Querying archiver over the investigation is not recommended. Try to generate a report and check the values.