AnsweredAssumed Answered

Mapping Parsers to Hosts

Question asked by David Eagen on Aug 7, 2018
Latest reply on Aug 10, 2018 by Eric Partington

Any suggestions on how to get NetWitness to correctly map parsers to hosts? It keeps mapping F5 Big IP and ciscorouter parsers to our RedHat instances. When opened a case with support but so far the answer they give is to manually map each of our 24,000 event sources by clicking through the web UI. That's just not acceptable. There must be a better way. Without correct parser mapping NetWitness is unusable as it can't figure out what a message is.