Custom mapping not working
I am trying to map three additional fields to ESM fields as mentioned below. But its not working. Kindly help me to understand the issue.I have also attached mapping file.
event.deviceCustomString3=PARAM DEVICE ID
Connector :- SymantecEndpointProtectionDBConfig
Custom map file place in below mentioned location
D:\ArcSight\Connectors\Symantec End Point\current\user\agent\aup\3S3GZ3k4BAB8SNx5Sw==\fcp\custommappings\Symantec\Endpoint_Protection
Thank you all.
Follow Hemant's doc. If issue persists.
Were u able to see the values in Get Additional data names and getstatus will show whether ur additional field mapping is loaded or not!!!
Sometimes, there are some bugs in connector versions(ex: 22.214.171.12475.0) especially pull connectors which doesn't work as expected. Try different connector versions
Thank you everyone for response ,issue now resolved.Tried as per document 4 to 5 times after few restart it worked.
@Hemat ,documents was very helpful.
@Balahasan, issue resolved but I was trying same method as per document from the beginning of the issue , some finally it worked.
@Gayan, Yes we are getting value in raw logs for those fileds.