madansudhindra

Create a header with multiple variables

Discussion created by madansudhindra on May 24, 2010
Latest reply on May 24, 2010 by RSA Admin

Hi,

 

I am trying to create a parser for the Trapeze MX8 wireless controller.

 

I have a few log entries that have multiple variables, and also match other log entries in terms of format.

 

For example -

 

1) May 06 14:50:38 [172.19.112.70] May  6 14:50:36 172.19.112.70 AP_NOTIFY: SW-find request from AP serial_id 09e3600651 mac 00:26:3e:21:7a:00 port 10 vlan MGMT failed

 

2) May 16 03:06:43 [172.19.112.70] May 16 03:06:46 172.19.112.70 AP 215 radio: atheros_ar5416_handle_event: Radio 1 has been jammed

 

In the above example, Log 1 has a message ID of AP_NOTIFY, while in Log entry 2, the ESI tool automatically selects a Message ID of AP 215 radio.

 

My problem is that i want  to set only "AP <hdevice> <hxxx>" as header variable for the second log entry, as the same can be repeated for different access points, and can have differnt categories like radio, network, etc.

 

is there any way to force the ESI tool to create a new header value ?

 

Thanks in advance,

Madan Sudhindra

Outcomes