how to create Custom parsers

[EdPadilla]

how to create Custom parsers. I am seeing this message. "SDK-Values fieldName responsepayload is not defined"

[DaveGlover]

Ed

What type of parser are you trying to create? Log or Packet. Are you using the LPT tool or the Log Parser rules in the UI?

Thanks

Dave

[EdPadilla]

An end user is getting this message:

SDK-Values fieldName service.desc is not defined...

So far in google I need to create a parser? I am a noob in this matter (Netwitness)

[KarimBenzina]

Hi Ed,

Can you make the same research using the log concentrator instead of a broker and check if you see the same error when visualizing service.desc? navigate> select the concentrator where data resides> reapply the same query

If it works and you are able to see properly the value, you don't have any parsing problem but probably just configuration issue. Please check the below link. I have provided a workaround for this issue https://community.rsa.com/thread/204129