How to let Taxonomy show Non Unknow value ?

Hi All

    I have some event source to use CEF collector to parse...

it seem work . But the report usually show Unknown in report as screenshot.

A Engineer said because Taxonomy field has no value...so it show "Unknown"

If I want to let these events (For eaxmple: when ExtendInfInformation has some key word , the Taxonomy will be record some information) to belong to success.

How to let CEF Collector to compare the contents of specific fields so that Taxonomy has data

Thank!!

Wencheng

Tags: