Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class
362 views

one connector multiple customer

Hi Team,

I am getting logs from multiple customer on single connector ,

Now i was to differentiate those logs using the customer name field.

As per quide there are 2 option to do so :

Velocity template variable &  connector map file

can some share some example of velocity template and connector map file, so that i can implement this.

Regards,

Naresh

Labels (2)
0 Likes
3 Replies

Hello Naresh,

You have two such examples in the document mentioned in the previous thread:

-> Page 21 Velocity Template:

"

#if($deviceHostName.endsWith("CUSTOMERNAME"))/All

Customers/MSSP/CUSTOMERNAME#elseif($deviceHostName.endsWith

("CUSTOMERNAME2"))/All Customers/MSSP/CUSTOMERNAME2#end

"

-> Page 23 Map Files

Have you already tried those?

All the best,

Stefan

0 Likes
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

Hi Stefan,

Thank you for your reply.

I haven't tried those yet.

first i want to know how its work :

#if($deviceHostName.endsWith("CUSTOMERNAME"))/All

Customers/MSSP/CUSTOMERNAME#elseif($deviceHostName.endsWith

("CUSTOMERNAME2"))/All Customers/MSSP/CUSTOMERNAME2#end

as per the above syntax if the device hostname end with the customer then only customer name will be tagged to that events.

but i want  to segregate customer on the basis of subnet (IP range), then what will be syntax ?

Regards,

Naresh

0 Likes

Hello Naresh,

For the time being I was not able to find a Velocity function dealing with IP Addresses.

However, you could use String functions on Address ArcSight Fields. I agree it is more complex, but it can be done nevertheless. For example I have successfully tested the following in the Customer URI Field:

"

#if($deviceAddress.startsWith("1.0.1."))/All Customers/MSSP/testCustomer1-Customer/testCustomer1#elseif($deviceAddress.startsWith("1.0.2."))/All Customers/MSSP/testCustomer2-Customer/testCustomer2#end

"

What this does is assign all logs coming in from deviceAddress within 1.0.1.0/24 to testCutomer1 and from deviceAddress within 1.0.2.0/24 to testCustomer2.

If you have networks that do not end on a clean /8, /16 or /24 boundary you will need more #if and #elseif conditions, but as I said it is doable.

All the best,

Stefan

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.