Not quite understanding your question.
Assuming by 2 sites, you mean you have 2 sites each with a concentrator/decoder pair, are they both reporting to the same SA server head, or is each site totally independent (2 different SA heads)?
If under the same SA head, and you are querying each concentrator separately in investigation window, and one site is showing the "url" metakey and the other is NOT showing the "url" meta key, there could be several causes:
- The same parsers are not loaded (and enabled) on the 2 decoders
- The traffic being consumed by the decoders is different (one is not seeing traffic that parses the "url" metakey)
- The index-concentrator-custom.xml files are different and one has the "url" metakey and the other does not have it (or the key is set to defaultAction="hidden" on one concentrator.
- Someone modified the "default meta keys" when connected to one of the concentrators in investigation, and changed the action on the "url" key to be visible, but when you connect to the other concentrator, it reads the default keys from THAT concentrator (not a global setting)
- the metakey is disabled in the parser(s) that generate it.
