Meta value is not being indexed
Eventhough we have described the meta key value to be indexed, it is not being indexed. Please suggest.
<key description="Sigid" level="IndexValues" name="sigid" format="UInt32" valueMax="999999" defaultAction="Open"/>
The above is the configuration for the Key description.
Have you restarted the Concentrator service? If you have, can you show the Meta view from and event from a recent time - since you changed index-concentrator-custom.xml and restarted the service - that shows that meta key being filled?
In looking at the table-map file the proper variable is sig.id not sigid. In your index-concentrator-custom file the name should be sig.id. Make the change, restart the concentrator and your values should be indexed.
the proper line should be:
<key description="Sigid" level="IndexValues" name="sig.id" format="UInt32" valueMax="999999" defaultAction="Open"/>
Hi Dave, The meta value is being parsed perfectly, but only we are not able to apply a filter on the same. Even in this case, do we have to change the name to "sig.id"
Hi Dave ,
This is the line for signature ID in table-map-custom
<mapping envisionName="sigid" nwName="sig.id" flags="None" envisionDisplayName="SignatureID"/>
Yes, so Dave's suggestion above is correct. The "sig.id" is the proper meta key for SignatureID. If you take his suggestion above and change your key as he described, it should work fine (after a service restart).