Using Explore to Synchronize Disabled Parsers across Decoders

Written by Admin | Oct 4, 2016 4:00:00 AM

This is a quick video that covers the following topics:

  • Using Explore to disable identical sets of parsers from one Log Decoder to another to keep an environment synchronized.
  • Using Explore to compare two like-services (just a byproduct of the above)
  • Using Explore to reload parsers and understanding how to verify it from /var/log/messages

The relevant locations where these values can be found in Explore are:

  • Log Decoder: Explore\Decoder\Parsers\Config\devices.disabled
  • Packet Decoder: Explore\Decoder\Parsers\Config\parsers.disabled
  • Reloading Parsers (both): Explore\Decoder>Right Click Parsers and choose "Properties". Under the dropdown list, choose "reload" and click "submit"