meta key not populated

[Anonymous]

Hi every one,

i have just integrated mcafee gateway with SA and i am able to see logs on SA but issue is that i am not getting meta key related to site visited by users while i am able to see that site related information in raw logs, is there any way to populate that meta key ?

attaching log file, kindly provide solution if anyone have any idea related to this.@ patriot_3w

[LeeKirkpatrick]

Hi Rajveer,

From what I can tell it looks like these URL's are being parsed into a field called "url" within the McAffee GW parser. By default this variable is set to transient in one of the configuration files which means it will not be shown in Investigator. In order to change this, SSH into your Log Decoder and open the following file:

vi /etc/netwitness/ng/envision/etc/table-map.xml

Search for the following line:

<mapping envisionName="url" nwName="url" flags="Transient" envisionDisplayName="URL"/>

And change it to:

<mapping envisionName="url" nwName="url" flags="None" envisionDisplayName="URL"/>

Then restart the nwlogdecoder service or reload parsers using the following command from the SSH console:

NwConsole -c login localhost:50002 <user> <password -c decoder/parsers reload

Give it a little while and see if this fields starts being populated under the URL field.

[huanzhou1 · Accepted solution]

You're correct.

Try below:

Change flags /etc/netwitness/ng/envision/etc/table-map.xml

        <mapping envisionName="url" nwName="url" flags="None" envisionDisplayName="URL"/>

Add        <key description="URL Links" format="Text" level="IndexValues" name="url" valueMax="500000" /> to index-concentrator-custom.xml

Then restart concentrator and jettysrv.

Done!