cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How I can change a value?

Hi,

I need change a value of an event. I want to explain you, I've a raw event and this has a value type "2020" (itis a code) I know that this value "2020" is a referer as "system configuration". If I set on the event "2020" it is "system configuration".

Now I would change the value "2020" for "system configuration" on new advanced syslog parser rule.

The code "2020" isn't only that code, I have several codes with theses description type:

- 2020 is system configuration

- 2021 is auth ok

- 2022 is auth error

------ serveral codes

My question is, can I put the description on the asp rule???? type mapping????

I hope that you can help me, please.

Thx

3 Replies
sssyyy
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 4

Re: How I can change a value?

Do you have sample logs? I would create the rule with name system configuration, and use the code 2020 as pre-matching string.

Re: How I can change a value?

Hi,

In data Enrichment????

Thx

sssyyy
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 4

Re: How I can change a value?

Oh, I meant when you write the custom asp rules.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community