Create a new Meta Key

[RenatoGoncalves]

Hello,

One of my colleagues are trying to create a new meta key. In this case we are trying to create the name of a customer and with that we could distinguish all out clients data.

We already did:

https://community.rsa.com/thread/194442

https://community.rsa.com/docs/DOC-80195

https://app-community.rsa.com/docs/DOC-45795

But when we try to search our client data using the meta key customer-name it isn't possible.

Is there anything my colleague could do?

Antonio Teixeira‌

[Anonymous]

Make sure the change is on ALL concentrators. They should all have the same index-concentrator-custom.xml file. Then, I typically logout and log back in to see the meta key.

If you can, please share the entry for the meta key from the index-concentrator-custom.xml file.

Chris Ahearn

RSA | Principal Consultant | Incident Response

[anuragsinha18]

Did you add the entry for custom meta in  table-map-custom.xml file in log Decoder?

[RenatoGoncalves]

Hello Christopher and Anurag

Yes we have made all that you said. 

Christopher here's the entry: 

index-concentrator-custom.xml é "<key description="Customer Name" format="Text" level="IndexValues" name="customer.name"/>"

table-map-custom.xml é " <mapping envisionName="customer.name" nwName="customer.name"/>"

[anuragsinha18]

Hi Renato,

Try with the below changes and restart the nwlogdecoder and nwconcentrator services.

Table-map-custom.xml entry;

<mapping envisionName="customer.name" nwName="customer.name" flags="None"/>

index-concentrator-custom.xml entry;

<key description="customer name" level="IndexValues" name="customer.name" format="Text" valueMax="10000" />

[RenatoGoncalves]

Let me try Anurag Sinha‌

[RenatoGoncalves]

Hello  Anurag Sinha‌,

We tried to do how you said but it gives us an error:

[anuragsinha18]

That seems to be error with the filter and option tried to search.  Confirm that original request to see the "customer.name" meta is resolved?

[RenatoGoncalves]

Sorry....but how can i confirm it? Doing a query?

[anuragsinha18]

have you used that meta in any of the parser? does that meta holds any data against it? If not, querying on that will not fetch any data.

You can check the meta in Investigate>Manage default meta keys

Hope this helps