Meta value is not being indexed

[GayathriPulla]

HI Team, 

Eventhough we have described the meta key value to be indexed, it is not being indexed. Please suggest. 

<key description="Sigid" level="IndexValues" name="sigid" format="UInt32" valueMax="999999" defaultAction="Open"/>

The above is the configuration for the Key description. 

[Anonymous]

Have you restarted the Concentrator service? If you have, can you show the Meta view from and event from a recent time - since you changed index-concentrator-custom.xml and restarted the service - that shows that meta key being filled?

[DaveGlover]

In looking at the table-map file the proper variable is sig.id not sigid.  In your index-concentrator-custom file the name should be sig.id.  Make the change, restart the concentrator and your values should be indexed.

the proper line should be:

<key description="Sigid" level="IndexValues" name="sig.id" format="UInt32" valueMax="999999" defaultAction="Open"/>

[GayathriPulla]

Hi Dave, The meta value is being parsed perfectly, but only we are not able to apply a filter on the same. Even in this case, do we have to change the name to "sig.id"

[DaveGlover]

Can I please see the line in the table-map or table-map-custom file that references this variable?

Thanks

[GayathriPulla]

Hi Dave ,

This is the line for signature ID in table-map-custom

<mapping envisionName="sigid" nwName="sig.id" flags="None" envisionDisplayName="SignatureID"/>

[Anonymous]

Yes, so Dave's suggestion above is correct. The "sig.id" is the proper meta key for SignatureID. If you take his suggestion above and change your key as he described, it should work fine (after a service restart).

[GayathriPulla]

Hi Sean, 

I have changed the name to "sig.id" but still there is no change in the same.

Thanks & Regards, 

Gayathri

[SravanKoneti1]

Hi Gayathi,

Try restarting jettysrv in SA server and query for recent data(the time after you starting indexing sig.id meta)

[GayathriPulla]

Hi Sravan, I have restarted the jettysrv, but still,the issue is same.