Export meta from Decoder and concentrator on netwitness V11

[AmbemouAngeOliv]

Hello All,

How i can export the metas from Decoder log / packets and concentrator ?

Thanks for your help

[EricPartington]

to export the meta for one key you can click on the drop down arrow on the left of the metaname and select export/view as CSV.  then you can copy and paste the values.

to export all the meta for all the keys in your view use the export button on the top menu bar and select meta and then pick your format (csv,tsv,json etc) to export.

[AmbemouAngeOliv]

Hello Eric,

Thanks for your answer it's possible to make this via Nwconsole or restAPI ?

[JoshRandall]

Hi Ange,

The "SDK-Query” command will let you export meta:

The API shows the following information for using  SDK-Query commands:

query: Performs a query against the meta database

security.roles: sdk.meta

parameters:

   id1 - <uint64, optional> The starting meta id (to run the query from most recent to oldest meta, make id1 larger than id2)

   id2 - <uint64, optional> The ending meta id

   size - <uint32, optional> The max number of entries to return, or just stream back all results if zero

   query - <string, optional> The query string to use

   flags - <string, optional> The flags to use for query.  Can be a number (bitwise mask) or comma separated values like query-log.

   threshold - <uint64, optional> Query optimization to stop processing results after the threshold is reached (useful with select aggregate functions).  Zero means no threshold (the default).

   partition - <uint32, optional> Used to partition the result set across multiple clients. Must be greater than zero and less than or equal to totalPartitions

   totalPartitions - <uint32, optional> The total number of clients that will be submitting the same query for partitioning.

For example:

            raw parameters:

id1=1 id2=9598353755 size=100000 flags=0 threshold=0 query="select*where sessionid=218505977"

            formatted for API query:

/sdk?msg=query&force-content-type=text/plain&id1=1&id2=9598353755&size=100000&flags=0&threshold=0&query=select*where%20sessionid%3D218505977