Absent Member.
Absent Member.
1528 views

Integration Command - [Logger Search]

Jump to solution

Hi Guy,

i have a en-quire to search raw log from ArcSight Console. and understand that ArcSight can achieve that by using integration command which will redirect URL to ArcSight Logger.

i have done the configuration base on the Express User Guide but i keep receive error HTTP 404 and error message" Failed to negotiate single use session token, please check with administrator. Proceeding with alternative authentication method ."

i try many time but can't found the root cause. my logger is latest version and Express is version 5.1

Attach error page.

hope anyone can give me a hand on this.

Many thanks!

Regards,

Chris LEE

Labels (3)
0 Likes
1 Solution
11 Replies
Absent Member.
Absent Member.

Sorry for the delay. I ran into this with a customer. I found your thread when searching for a solution. The URL format has changed a bit between what is pre-programmed into ArcSight and what actually works on the Logger.

Change the URL between #else and #end in the "Quick Search Integration Command"

Delete the /app/redirect?user=${LoggerUser}&pass${LoggerPassword}&redirectUrl=

The URL will look like https://${LoggerHost}/logger/search.ftl?search.ftl&[...]

This will launch a new browser window where you'll have to authenticate. However, once you authenticate the search you've selecetd will run.

0 Likes
Absent Member.
Absent Member.

Update URL:

https://{hostname or IP address}/logger/search.ftll?ehr=1&ausm_query={event field to query on}=$selectedItem&from=${start time}&to=${end time}

Example:

https://0.0.0.0/logger/search.ftll?ehr=1&ausm_query=destinationAddress=$selectedItem&from=${Now-1w}&to=${Now}

This will open a browser with the login screen. Once you login you will be automatically redirected to the results page.

0 Likes
Absent Member.
Absent Member.

I am trying to get the logger integration commands to work with Logger without any luck.  Does your example above still work?

0 Likes
Absent Member.
Absent Member.

Hi Vaishnavi,

Query you have mentioned is not working,

I am giving inputs like this:

https://10.63.140.73:9000/logger/search.ftll?ehr=1&ausm_query={destinationAddress}=$selectedItem&from=${Now - 1d}&to=${Now}

Error I am getting

We're sorry, but the page was not found.

Can You help here?

need your inputs too.

0 Likes
Absent Member.
Absent Member.

Amazing...Thanks alot Bala

0 Likes
Fleet Admiral
Fleet Admiral

, , isn't Jonathan Katz' response the correct answer here?

0 Likes
Absent Member.
Absent Member.

, nominated his answer as being correct here. , what do you think?

0 Likes
Fleet Admiral
Fleet Admiral

Hi Grace,

Yes. It's Jonathan's the actual response is the correct here. There was a separate track question from Aniruddh and John. I thought it was the actual question thread... My bad.. Please mark Jonathan's Answer

Thanks for Noticing

0 Likes
Fleet Admiral
Fleet Admiral

Yep, looking at the whole thread in context, I can see where it forked from one question to another. We should try to flag those in the future and encourage the question-askers to create a new discussion. , it'd be great if power-users could tag comments for stuff like this. Just a thought

0 Likes
Absent Member.
Absent Member.

Yes, that would be great. Thanks for keeping a close eye on it and I saw where the fork diverged too. Keep it up!

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.