Not storing meta values with specific values

[TomiReiman]

What is the best way to configure SA not to store a certain meta value is the parser value is someting predefined?

An example:

A proxy log might have the following substring: "referer=-" or "referer=www.google.fi".

I realize this can be done by modifying the message definition in the XML parser to "referer={-|<referer>}", but is there an alternative way of doing this?

I am more spefically interested in the nullTokens attribute in the table-map.xml and table-map-custom.xml files. Is this attribute for this exact purpose, meaning that I could define:

<mapping envisionName="referer" nwName="referer" format="Text" flags="None" nullTokens="-" /> to prevent the referer value of "-" from being stored? If so, is there a performance difference between the two approaches?

[Anonymous · Accepted solution]

Tom

We've made a number of modifications to NullTokens in the table-map-custom.xml.  There doesn't seem to be a noticeable performance impact to doing so - and this avoids the need to modify an RSA provided parser, which was another concern for us.