2017-06-05 05:38 PM
For sessions like those between DNS servers, there are multiple alias.host records captured in one session. Is it possible to create a column group which will show each unique alias.host record in the events tab?
2017-06-06 09:55 AM
Unfortunately, no. The meta displayed in the events view is the first value. If a meta key had multiple values in the same session, like alias.host in the example you described, then only the first value would be displayed in the 'alias.host' meta key.
However, it may be possible to concatenate these values with a parser. Please note that text formatted meta keys, like alias.host, have a 256 byte size limit. Anything after 256 bytes would be truncated. I wrote a parser to test this out which seemed to do what I expect but am looking for a better way to do it.
If the concatenated list is longer than 256 bytes, the parser will simply append "..." to the value. This can be displayed in the events view.
Please note that in this example, the same would need to be done with alias.ip since that shows the resolved IP address.
Not sure this parser is production ready, but was able to show what is possible given the variables.
Chris
2017-06-08 05:55 PM
Christopher, thank you for clarifying and trying to come up with a solution. At least now I know it won't be an easy fix. I've passed your response on to our engineers.