Step 3. Configure Aggregate Services

This topic introduces basic tasks related to data aggregation on Brokers and Concentrators. For information on the optional setup of group aggregation, see Step 4. (Optional) Configuring Group Aggregation.

Configuring the aggregate services (whose data is consumed and aggregated) includes:

  • Adding, editing, and deleting Concentrators and Decoders as aggregate services
  • Toggling an aggregate service online and offline

netwitness_step3-110_brokerconcentrator_configworkflow.png

To configure aggregate services to a Broker or Concentrator:

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.

  2. In the Services view, select a Broker or Concentrator, and select netwitness_ic-actns.png > View > Config.

    The Services Config view for the selected service is displayed.

    netwitness_121_serviceconfigview1_generaltabbrokr113_1122_2487x1403.png

  3. Click netwitness_ic-add.png in the Aggregate Services toolbar.

    The Available Services dialog is displayed.

    netwitness_121_step3_aggregateservices_3_1122.png

  4. Select one or more services to be added and click OK.

  5. Use one of the following ways to add a service for aggregation:

    • Use Password-Based Authentication. Enter the Administrator username and password. Click OK.

      netwitness_password_authentication_321x236.png

    • Select Trusted Authentication. Click OK.

      netwitness_trusted_authentication.png

    The added services are listed in the Aggregate Services list.

  6. To save the changes, click Apply.

To remove aggregate services from a Broker or Concentrator:

Note: This option applies only to offline services. If the aggregate service is online, you must first toggle the service offline.

  1. In the Aggregate Services list, select one or more services.
  2. Clicknetwitness_delete.pngin the toolbar.
    netwitness_step3_removeservice.png
    The service is removed from Aggregate Services list.

  3. To save the change, click Apply.

To edit aggregate services on a Concentrator:

Note: This option applies only to offline services. If the aggregate service is online, you must first toggle the service offline. You can edit only one service at a time.

You can limit the data being consumed from an aggregate service using meta fields and filters.

  1. Click Change Service to change the service to Concentrator.
  2. In the Aggregate Services list, select one or more services.

  3. Click netwitness_ic-edit_18x14.png in the toolbar. Enter the authentication information in the pop up dialog box.

    • If the service was added on a different instance of NetWitness, you must add it to this instance of NetWitness in order to edit. A warning dialog allows you to add the service. If you click Yes, the Add Service dialog is displayed.
    • If the service is online, a dialog notifies that the service must be offline and requests confirmation that you want to continue. If you click Yes, NetWitness takes the service offline and the Edit Aggregate Service dialog is displayed.
    • If the service is offline, the Edit Aggregate Service dialog is displayed with the editable properties for an aggregate service on a Concentrator.

  4. Click a type of metadata in the Meta Include tab to select the type of metadata for the Concentrator to consume from this service. Click Save.

    netwitness_step3_configureaggregate_3metainclude_338x391.png

  5. To specify a rule to filter data that the Concentrator consumes from this service, compose a rule in the Meta Filter tab. Click Save.

  6. Click Close.

    The Edit Aggregate Service dialog closes and the changes are shown in the Aggregate Services list. In this example, two meta were selected on the Meta Include tab. When you click the information icon in the Meta Include field, it shows the selections.

  7. To save the changes, click Apply.

Toggle a Service

When data aggregation starts, Brokers and Concentrators consume data from aggregate services that are online. When first added to a Broker or Concentrator, aggregate services are offline.

To toggle a service between online and offline:

  1. Select a service in the Aggregate Services list.

  2. Click netwitness_togglesvc.png.

    The status is changed.