About Archivers

[VishamRawat]

How can we include a metakey for storage on the Archiver? I see the device.host is not included. Unable to generate historical reports on this metakey.

Also, when we query the Archiver for session size (in bytes), it shows us the total session size stored for the metakey before compression, right?

[DaveGlover]

Visham

On the archiver config page you will see a ‘meta’ section. This will show you all the keys being sent to the archiver.

In the explorer page under the device config you will see a ‘meta include=‘ statement. This is where you would add additional keys to be brought over to the archiver. If you want to report on those keys, you would also need to add them into the index-archiver-custom file

[NandakumarVadiv]

Hi 

Refer below article to add additional meta key's to archivers

000033597 - How To Add Additional Meta Keys to the RSA NetWitness Archiver Service 

Querying archiver over the investigation is not recommended.  Try to generate a report and check the values.

Regards,

Nandakumar

[VishamRawat]

The session size displayed on the Archiver is pre-compression right?