Hello,
I need create 3 customs metakeys for use them on a custom feed. so I add this line in "index-logdecoder-custom.xml" file (LogDecoder server) :
<Key description="Sede" level="IndexNone" name="tdp.sede" format="Text"/>
<Key description="Ciudad" level="IndexNone" name="tdp.ciudad" format="Text"/>
<Key description="Tipo Red" level="IndexNone" name="tdp.red" format="Text"/>
And this lines in "/etc/netwitness/ng/index-concentrator-custom.xml" file (Concentrator server) :
<Key description="Sede" level="IndexValues" name="tdp.sede" format="Text" valueMax="10000" defaultAction="Closed"/>
<Key description="Ciudad" level="IndexValues" name="tdp.ciudad" format="Text" valueMax="10000" defaultAction="Closed"/>
<Key description="Tipo Red" level="IndexValues" name="tdp.red" format="Text" valueMax="10000" defaultAction="Closed"/>
But on 'Investigate' I see no index values
So, any ideas why I don't get IndexValues?
You also need to add those keys to the table map custom file on the log decoder