Hello,
One of my colleagues are trying to create a new meta key. In this case we are trying to create the name of a customer and with that we could distinguish all out clients data.
We already did:
https://community.rsa.com/thread/194442
https://community.rsa.com/docs/DOC-80195
https://app-community.rsa.com/docs/DOC-45795
But when we try to search our client data using the meta key customer-name it isn't possible.
Is there anything my colleague could do?
Did you add the entry for custom meta in table-map-custom.xml file in log Decoder?
Hello Christopher and Anurag
Yes we have made all that you said.
Christopher here's the entry:
index-concentrator-custom.xml é "<key description="Customer Name" format="Text" level="IndexValues" name="customer.name"/>"
table-map-custom.xml é " <mapping envisionName="customer.name" nwName="customer.name"/>"
Hi Renato,
Try with the below changes and restart the nwlogdecoder and nwconcentrator services.
Table-map-custom.xml entry;
<mapping envisionName="customer.name" nwName="customer.name" flags="None"/>
index-concentrator-custom.xml entry;
<key description="customer name" level="IndexValues" name="customer.name" format="Text" valueMax="10000" />
A related question - in my environment, we are at v11.1. At what point do we start using index-logdecoder-custom.xml instead of table-map-custom.xml for custom meta?
Regards,
Kevin
That seems to be error with the filter and option tried to search. Confirm that original request to see the "customer.name" meta is resolved?
Sorry....but how can i confirm it? Doing a query?
have you used that meta in any of the parser? does that meta holds any data against it? If not, querying on that will not fetch any data.
You can check the meta in Investigate>Manage default meta keys
Hope this helps
Checking Manage Default Meta Keys we can see customer.name.
So this confirms on the new meta key created.
Ok...
But when we try to query for the meta key ist stills gives the error.
We have another instance and it works.
My colleague who is responsible for that already matched both instances and the meta key are equally created, but in one we can query with customer.name and in the other it doesn't work.
seems to be issue with your environment. Contact RSA Support.
Thanks for the help
Make sure the change is on ALL concentrators. They should all have the same index-concentrator-custom.xml file. Then, I typically logout and log back in to see the meta key.
If you can, please share the entry for the meta key from the index-concentrator-custom.xml file.
Chris Ahearn
RSA | Principal Consultant | Incident Response