I would like to export my event count either from the GUI or via a
report. Ideally, I would like to be able to drill into the data a bit,
for example1) Events per time period (where time period could be second,
hour, day)2) Events per time period per...
I'm having issues creating a message with the LPT tool using the TagVal
option. I have read the LPT user guide, specifically this section: The
Name Value Pair is disabled by default and it is enabled for user input
only if the message definitions sat...
I have a large environment both in terms of monitored devices (logs &
packets) and Netwitness infrastructure (many decoders, concentrators,
and brokers). A team that is standing up new devices to be monitored
have started sending logs (they say) to a...
A related question - in my environment, we are at v11.1. At what point
do we start using index-logdecoder-custom.xml instead of
table-map-custom.xml for custom meta? Regards,Kevin
I had the exact same problem. Then, I checked if the "Default Parser"
was available by ...um... default on my v11.1 decoder(s). It wasn't.
Aha! So, I searched on Live for "default" and found the "Default
Parser".Downloaded the default.envision file.U...
Short update. Dave Glover showed me that it is necessary to force a
Message ID using Concatentation, then create the keys for one of the
messages. At that point the checkbox for "Name Value Pairs" becomes
selectable.
Dave, I'm parsing outside of the CEF parser for a few reasons. I looked
at the default CEF parser and it doesn't have the technology we're using
in its vendor map. We're actually customizing the event details from
this tech before it reaches the deco...
Dave, Would you be able to do a short video demonstrating the the TagVal
option? I have read the LPT user guide, specifically this section: The
Name Value Pair is disabled by default and it is enabled for user input
only if the message definitions sa...
