i'm trying to create a custom multiple index feed on Nw 11.2 following the guide described here 000035599 - Creating custom feeds with multiple indexed meta keys for RSA Security Analytics 10.6.x .
As a first thing i'm using the same .xml and .csv files provided in the guide and i'm sendings custom logs modified for matching the .csv file. Even if the procedure for create the custom feed ends successfully without errors, the feed doesn't work on 11.2 environment because there were no changes in the parsed metas after sendind logs, instead of populate the additional metas described in the feed. Instead it works on 10.6 environment using the same guide.
There are a differents procedures for Nw 11.2 or for some reasons multiple index feeds doesn't work on 11.2?