AnsweredAssumed Answered

Not storing meta values with specific values

Question asked by Tomi Reiman on Jun 16, 2015
Latest reply on Jun 17, 2015 by Andy Cunningham

What is the best way to configure SA not to store a certain meta value is the parser value is someting predefined?

 

An example:

 

A proxy log might have the following substring: "referer=-" or "referer=www.google.fi".

 

I realize this can be done by modifying the message definition in the XML parser to "referer={-|<referer>}", but is there an alternative way of doing this?

 

I am more spefically interested in the nullTokens attribute in the table-map.xml and table-map-custom.xml files. Is this attribute for this exact purpose, meaning that I could define:

 

<mapping envisionName="referer" nwName="referer" format="Text" flags="None" nullTokens="-" /> to prevent the referer value of "-" from being stored? If so, is there a performance difference between the two approaches?

Outcomes