Hello,
before Netwitness 11.3, we were using the meta "esa.time" in some correlation rules with Esper Date-Time Methods.
After upgrading to version 11.3+ we noticed that the "esa.time" does no longer exists and of course our old rules were no longer deployed.
Is this meta deprecated or replaced with something else?
Thanks
Luca
Hello Luca,
I would like to understand your usage of the meta "esa.time" within your rules before recommending anything, but the way we define various timestamps wrt the meta are as follows -
If you would like to use actual event time, you should set your "timeFieldMeta" to "time" or "event.time" whichever you prefer based on the rules. If you didn't, then use-event-time would be set to false, whereby it uses ESA aggregation time "esa.time" for analysis.
Hope this helps.
Thanks.
Rohit