Create a new Meta Key
One of my colleagues are trying to create a new meta key. In this case we are trying to create the name of a customer and with that we could distinguish all out clients data.
We already did:
But when we try to search our client data using the meta key customer-name it isn't possible.
Is there anything my colleague could do?
Make sure the change is on ALL concentrators. They should all have the same index-concentrator-custom.xml file. Then, I typically logout and log back in to see the meta key.
If you can, please share the entry for the meta key from the index-concentrator-custom.xml file.
RSA | Principal Consultant | Incident Response
Hello Christopher and Anurag
Yes we have made all that you said.
Christopher here's the entry:
index-concentrator-custom.xml é "<key description="Customer Name" format="Text" level="IndexValues" name="customer.name"/>"
table-map-custom.xml é " <mapping envisionName="customer.name" nwName="customer.name"/>"
Try with the below changes and restart the nwlogdecoder and nwconcentrator services.
<mapping envisionName="customer.name" nwName="customer.name" flags="None"/>
<key description="customer name" level="IndexValues" name="customer.name" format="Text" valueMax="10000" />
have you used that meta in any of the parser? does that meta holds any data against it? If not, querying on that will not fetch any data.
You can check the meta in Investigate>Manage default meta keys
Hope this helps