About mustafag

lakshman239 · ‎02-24-2020

Generally the TA should means to extract required eventtype (s) to map to Email data model. If it isn't and you are writting custom TA or updating existing TA, I would suggest not combine all events to get full email transaction, but have one or more events only for inbound email and one or more outbound. This way you can create eventtypes for inbound and outbound and then map them to Email datamodel.

mustafag · ‎10-10-2018

Hi, I am integrating the logs from database and one of the log data column is contain the XML data. This XML data format is different based on other database field value. How can I convert the XML data in proper format?

mustafag · ‎10-10-2018

Fix the Issue with SQL query.

kamlesh_vaghela · ‎09-12-2018

@mustafag Please use below search. YOUR_SEARCH | eval data2=if(substr(data1,1,1)=="0",data1,if(len(data1)==7,data1, "0".data1))

aakwah · ‎05-25-2017

I believe that allowing EXTRACT to work after KV_MODE is intended to make some tweaks on the automatically extracted fields.

wenthold · ‎05-24-2017

To retain the original value I would just rename the original "action" field to something like orig_action or vendor_action (as another response indicated) but then use a lookup to use the new CIM compliant "action" field - it would be something like: ... | rename action AS orig_action | lookup {LOOKUP TABLE DEF} {VENDOR ACTION COLUMN NAME} AS orig_action OUTPUT {CIM ACTION COLUMN NAME} AS action

mustafag · ‎05-04-2017

Got the answer. Just used the Join statement in db input configuration as both table was on same database.

Posts	15
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎04-25-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Issue with CIM Mapping for ES

DbConnect with XML

How do I fix Dbconnect issue where logs from datab...

Can you help me extract and replace a new field fr...

remove the special character ' from beginning and ...

field rename help

dbinput with dbquery

Re: Issue with CIM Mapping for ES

DbConnect with XML

Re: How do I fix Dbconnect issue where logs from d...

Re: Can you help me extract and replace a new fiel...

Re: remove the special character ' from beginning ...

Re: field rename help

Re: dbinput with dbquery

Join the Conversation