Idea ID 2765872
Many customers are complaining about existing Arcsight Fields. It is not sufficient to map the available data fields from various log sources. There are a lot of fields are coming as blank due to the “provided field name”. Customers cannot map the data items. During data mapping, data items to FlexString 1 and Flexstring 2 has already mapped still, there are many data items of string type is pending, which cannot be mapped to ESM. The customer was complaining about other competitor products where they can create own customized field to map the data fields, but in ESM there is no such feature available.
There should be a solution available to add new fields to ESM.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.