AnsweredAssumed Answered

Question on Netwitness custom parser

Question asked by Jose Lopez-Villela Employee on Dec 27, 2019
Latest reply on Feb 5, 2020 by Jose Lopez-Villela

Hello all,


Recently, I configured a new custom parser for a customer, and successfully modified all index-concentrator-custom, index-logdecoder-custom and  table-map-custom files, across three separate concentrators and log decoders, to include 4 new metakeys. Restarted concentrator and log decoders processes, and new parser showed up fine, and metas are available for investigate meta groups. 


However, when using the investigate screen and selecting broker to query the meta information, I got a lot of metas, and not only the ones I created (but those included too), showing the following message on investigate screen instead of their values:


SDK-Values fieldname XXXX is not defined for device xx.xx.6.83:56005. 


But if the device for investigate is the concentrator directly instead of broker, then no message is displayed and all meta values are shown correctly.


Is there any additional configuration that I may have overlooked for installing the custom parser on the decoders, so the query works on broker also? Does broker need any specific configuration as index-xxx-custom files?


Thanks for any help you can provide,