multiple conditional map

wsa 5 months ago

Dear i need your help with multi level conditional map ,

this is winc parser configurations as follow:

i have issue in "conditionalmap[0].mappings[3].values=Sag:SN-I-2000" and in "conditionalmap[0].mappings[2].values=Sag:SN-I-1000" as it take and parser everything except the fields after

"conditionalmap[0].mappings[2].mappings.count=2
conditionalmap[0].mappings[2].mappings[0].values=HandleResponse"

or after "conditionalmap[0].mappings[3].field=event.deviceAction
conditionalmap[0].mappings[3].mappings.count=2

any help please as in dev guid i can't find anything related to multi level conditional mapping

Tags:

arcsight #winc #conditional #map #windows # issue #swift #guide #customparser #parser

0 vtham1 5 months ago

Hi wsa I'm not sure that a multi-level conditional map works. Since I see that you're still doing a lot of regex on the conditional mappings, I would suggest instead to use submessage parsing instead of conditional mapping for this purpose. I don't know that submessage parsing will work on the delimited parser, so if it doesn't then my suggestion would be to send deviceEventClassId to an extra processor parser in which you can use regex and submessage parsing on it. That should allow you to have more flexibility for the results you want.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Menu

ArcSight Discussions

multiple conditional map

Tags:

Resources