how to create Custom parsers
An end user is getting this message:
SDK-Values fieldName service.desc is not defined...
So far in google I need to create a parser? I am a noob in this matter (Netwitness)
Can you make the same research using the log concentrator instead of a broker and check if you see the same error when visualizing service.desc? navigate> select the concentrator where data resides> reapply the same query
If it works and you are able to see properly the value, you don't have any parsing problem but probably just configuration issue. Please check the below link. I have provided a workaround for this issue https://community.rsa.com/thread/204129