How to create multi line parser ?
Ex Logs : filed 1 = value1
filed 2 = value2
field 3 = value3
i want to create parser for this kind of logs. I am use to create parser for single line logs.
But not multi line logs.
Unfortunately Netwitness can only handle single line log messages.
You would need to use a preprocessor such as a perl or python script to convert it into a single line, and then send it into Netwitness
I'd recommend submitting a feature request for this. we have a couple event sources that we cannot parse because of this limitation as well. The most requests for this, the more cannon fodder we can get RSA to push this ability.
Retrieving data ...