Multiline parser

[YogeshMavani]

How to create multi line parser ? 

Ex  Logs :  filed 1 = value1

                  filed 2 = value2

                 field 3 = value3 

i want to create parser for this kind of logs.  I am use to create parser for single line logs. 

But not multi line logs.

[DaveGlover]

Unfortunately Netwitness can only handle single line log messages.

You would need to use a preprocessor such as a perl or python  script to convert it into a single line, and then send it into Netwitness

Thanks

Dave

[JoeGumke]

hi yogesh,

I'd recommend submitting a feature request for this. we have a couple event sources that we cannot parse because of this limitation as well. The most requests for this, the more cannon fodder we can get RSA to push this ability.