AnsweredAssumed Answered

How create a custom feed with "device.ip" (MetaCallback)

Question asked by pbLIdKlYvbBgo8kdKjrKwU2jRwsX1GZqAvdEvcaKjzA= on Apr 1, 2016
Latest reply on Dec 12, 2016 by Leonard Chvilicek

Hello comunity,

 

Sorry if this question has been asked but i do not find the solution....

I try to create a feed with CIDR type index column and the "device ip" on meta callback. But she does not work.

 

My custom meta work with another feed. But Only meta "ip.src" or "ip.dst" is considerate for the indexation with a feed on CIDR. I read in forum or RSA documentation that custom xml with "metacallback" attribut allows to select another meta for indexing, but I can't ...

 

May be is my xml file or a bad practice ? I try 2 xml with <MetaCallback> but nothing. What do you think, Can you help me please ?

 

- My meta is in "index-concentrator-cutom"

- My XML and my CSV File :

or i try like that :

- My CSV :

 

- I have restart the nwconcentrator service but nothing :

Outcomes