Hi All,
If i create a custom metakey in 'index-logdecoder-custom.xml' and restart the service, will it cause any issues to the existing metakeys ? i am wondering whether RSA will read both custom decoder xml file as well as default decoder xml file. Thanks in advance.
Hi Jees
i am wondering whether RSA will read both custom decoder xml file as well as default decoder xml file
Yes - that is the purpose of the design for the -custom.xml files. It allows you to make changes to the index settings to override the default settings. It also ensures your changes are not lost if RSA updates the default index file.
When creating new meta for use with log collection, you may also need to update the table-map-custom.xml file (to map metadata generated by the log parsers to your new meta) and also the event source's parser file to generate the meta. More information on the table-map.xml file can be found here: Host GS: Maintain the Table Map Files
More information on log parsers and log collection in general can be found here: Log Collection Guide for Version 10.6.4 - Table of Contents
Thanks for reply
Also, please note that in addition to what Chris Thomas stated above, the meta key should also be added to the index-concentrator-custom.xml file on the concentrators IF you plan on querying that meta. Otherwise, the meta will be part of the sessions to review, but just not something you would query directly.
Chris
Hi Jees,
I have moved this thread to the RSA NetWitness Platform so that you can get an answer to your question.
You can post future questions and discussions directly to that community by clicking on the Ask a Question or Start a Discussion button on the RSA NetWitness Platform page.
Thanks,
Jeff