RSA Admin

ESI parser creation error- "header parsed and message not parsed"

Discussion created by RSA Admin Employee on Nov 21, 2015

I am trying create a parser for an unsupported event source for which I am getting  the logs in CEF format.

In ESI I am able to define the header and payload, but while testing I am getting the above mentioned error message.

Can some one help with a resolution?

 

Log sample: CEF:0|XYPRO|NONSTOP|XMA|XYGATEAC-SUCCESS-OTHER|XYGATEAC-SUCCESS-OTHER|5| cs3= 000000000000000000000000001E0B0E7586 SessStart= N SessEnd= N cs4=  sproc=  SessProcID2=  filePath=

 

Thanks In advance! 

Outcomes