Edit a Parsed meta value and remove unwanted data

[NijoDavid]

I need to edit a parsed meta value and remove an unwanted data from the parsed data.can some one help me with this.

example:-

raw log value:-

obj = getval "nijo.d@xxxx.com" 

meta parsed:- 

obj.name = getval "nijo.d@xxxx.com"

required value:- 

obj.name =  "nijo.d@xxxx.com"

Please help me on this

[JohnKisner]

Nijo,

So you are saying you have the meta key obj.name containing "getval'nijo@xxxx.com'" and all you actually want in the obj.name is the email address nijo@xxxx.com?

If this is the case you may have to create a custom parser to get it to cut off the getval part. To do this you will need a few things.

1. The Log Parser Tool which can be found here: https://community.rsa.com/docs/DOC-94172

2. A raw log that contains the data in it that you want parsed differently.

3. A copy of the parser from one of your Log Decoders that matches the event source that produces this log.

4. Put the parser and the log into the Log Parser Tool

5. Use the guides and free on demand learning from the Log Parser Tool page to modify the parser how you want.

6. Add and enable the parser in your environment.

I hope this helps.