HI Team,
Eventhough we have described the meta key value to be indexed, it is not being indexed. Please suggest.
<key description="Sigid" level="IndexValues" name="sigid" format="UInt32" valueMax="999999" defaultAction="Open"/>
The above is the configuration for the Key description.
In looking at the table-map file the proper variable is sig.id not sigid. In your index-concentrator-custom file the name should be sig.id. Make the change, restart the concentrator and your values should be indexed.
the proper line should be:
<key description="Sigid" level="IndexValues" name="sig.id" format="UInt32" valueMax="999999" defaultAction="Open"/>
Hi Dave, The meta value is being parsed perfectly, but only we are not able to apply a filter on the same. Even in this case, do we have to change the name to "sig.id"
Can I please see the line in the table-map or table-map-custom file that references this variable?
Thanks
Hi Dave ,
This is the line for signature ID in table-map-custom
<mapping envisionName="sigid" nwName="sig.id" flags="None" envisionDisplayName="SignatureID"/>
Yes, so Dave's suggestion above is correct. The "sig.id" is the proper meta key for SignatureID. If you take his suggestion above and change your key as he described, it should work fine (after a service restart).
Hi Sean,
I have changed the name to "sig.id" but still there is no change in the same.
Thanks & Regards,
Gayathri
Hi Gayathi,
Try restarting jettysrv in SA server and query for recent data(the time after you starting indexing sig.id meta)
Hi Sravan, I have restarted the jettysrv, but still,the issue is same.
Hi Gayatri,
By default, sig.id defined as flags="None" table-map.xml as below.
<mapping envisionName="sigid" nwName="sig.id" flags="None" format="Int32" envisionDisplayName="SignatureID" failureKey="sig.id.str" nullTokens="(null)"/>
So, please remove this entry in table-map-custom.xml file.
Please change below entry in index-concentrator-custom.xml.
From:
<key description="Sigid" level="IndexValues" name="sig.id" format="UInt32" vvalueMax="999999" defaultAction="Open" />
To:
<key description="SignatureID" level="IndexValues" name="sig.id" format="Int32" vvalueMax="999999" defaultAction="Open" />
Please restart logdecoder and concentrator service post changes.
HI Sravan, I have changed the values as recommended and restarted the concentrator as well as jettysrv, But still it is showing the same.
Hi Gayatri,
Are you investigating against same concentrator or broker? Please check.
If investigating against broker, please edit index-broker-custom.xml as well.
Hi Sravan, I am investigating against same concentrator itself, but still facing same issue.
Hi Sravan, Now, its seen in blue color, but able to apply filter on the same, what might be issues, I have updated same through cli and then it changed.
Good to hear Gayathri:)..I would use CLI for editing XML files.
Hi Sravan,
Even it is being indexed, still we are able to apply filter on the values.. Can u please suggest on this?
Have you restarted the Concentrator service? If you have, can you show the Meta view from and event from a recent time - since you changed index-concentrator-custom.xml and restarted the service - that shows that meta key being filled?