Test Rule stuck on loading

[YossiNagar]

Hi,

I'm trying to test some rules i'm building to see the results, but once i'm run ning the rule it's loading forever and not presenting any results. The system even not returning message like "No Results".

Will appreciate any help.

Thanks,

Yossi.

[SravanKoneti1]

Hi Yossi,

Looks like you don't have meta values for what you are trying in reports.

First, Please run queries in the investigation for the meta values using Investigation: Query Data in Navigate View for the duration.

If data shown in investigation page, same data can be shown for same duration in Report->Rules output.

[YossiNagar]

Hi Sravan,

Looks like you're right..

If so, how can i import meta values to the system. Shluld i add to the Custom-xml file in the Decoder?

[SravanKoneti1 · Accepted solution]

Hi Yossi,

Default meta keys are already defined in table-map.xml in logdecoder.

1. Please check whether you are getting logs from device you want to query.

2. If logs are coming, do you see meta values in the investigation page.

3. If you don't see meta values for specific meta keys, check parsing for that meta keys.

4. If parsing is problem, either you reach out support for parser update or build your own custom parser using ESI tool: RSA NetWitness ESI Tool Downloads .

5. If parsing works for meta key, then you may need to define in table-map-custom.xml and index-concentrator-custom.xml using https://community.rsa.com/docs/DOC-45327  steps.

[YossiNagar]

Perfect!

Thank you vety much