How to reload parsers on a Decoder or Log Decoder via the NetWitness UI

[#1]

Article Number

000001785

Applies To

Product Set: Security Analytics, NetWitness
Product/Service Type: NetWitness UI, Decoder, Log Decoder
NetWitness Version/Condition: 11.X/12.x
Platform: CentOS 7 / Alma

 

Issue

How to reload parsers on a Decoder or Log Decoder via the RSA Security Analytics UI.

Resolution

To perform a parser reload on a Decoder or Log Decoder in the RSA NetWitness UI, follow the steps below.

1. In the RSA NetWitness UI, navigate to Administration/Admin > Services.
2. Select the appropriate device and click on View > Explore.
3. In the directory tree, navigate to decoder > parsers.
4. Right-click on the parsers directory and select Properties.
5. In the drop-down menu in the lower-right side, select reload.
6. Click on the Send button.

If the operation was successful, the Response Output field will be populated with the following message:  "The parsers have been reloaded"

If this does not solve your issue, please open a case with RSA Technical Support and reference this article so that we may better assist you.

Notes

Below is a screenshot of the parsers reload procedure via the RSA NetWitness UI. 

Image description

For instructions on performing parsers reload via the NwConsole utility, refer to the Knowledge Base article: How to reload parsers on an RSA NetWitness decoder or log decoder using NwConsole.