I need change a value of an event. I want to explain you, I've a raw event and this has a value type "2020" (itis a code) I know that this value "2020" is a referer as "system configuration". If I set on the event "2020" it is "system configuration".
Now I would change the value "2020" for "system configuration" on new advanced syslog parser rule.
The code "2020" isn't only that code, I have several codes with theses description type:
- 2020 is system configuration
- 2021 is auth ok
- 2022 is auth error
------ serveral codes
My question is, can I put the description on the asp rule???? type mapping????
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.