NetWitness Community

Hello   logdecoder "logStats" API job (Retrieve count and last receive times for log devices, sources and forwarders) is interesting, but not modifiable enough.   curl https://______:50102/decoder?msg=logStats&force-content-type=text/plain device:vontu_monitor forwarder:nwlogtest source:22.1.88.24 discoveredType:vontu_monitor count:622950 lastSeenTime:2023-May-26 07:05:20 lastUpdatedTime:2023-Jun-06 07:41:48   it would be useful to be able to define the metas used in the job. For example, on our platform, source ip of a device isn't device.ip but another custom meta. so we didn't use this feature.   Could you make it possible to configure the metas used in this job in explore view ?   thanks. ... View more

Respond Server is offline ERROR DESCRIPTION The Respond Server is not running or is inaccessible. Check with your administrator to resolve this issue. View online documentation for details about the error. I am encountering this error  after deployment of netwitness server. Respond server is failing to start. ... View more

I am having an issue with a Lua Parser where my callback is getting a match but it is not looking for further matches because the next match is too far down in the tcp session.  In my lab i tried setting the "Maximum Session Meta" key to "0" on the decoder.  That didn't work either.  Any suggestions on how to look further in the stream to detect additional pattern matches would be appreciated. ... View more

Newbie here. How to setup Netwitness metadata feed into Splunk. If possible be has granular or detail for me ... View more

We have a problem with character encoding in CSV files generated by scheduled reports in NetWitness. Reporting engine creates CSV files only with UTF-8 encoding, which MS Excel is unable to process correctly and it displays special/national characters as garbage. We need a possibility to change the encoding of CSV files generated by Reporting engine to UTF-8 BOM or windows-1250, which can both be displayed by Excel correctly. ... View more