Hi Anil - One problem here is that a failed assignment expression in the REPL does not provide a helpful error message. I submitted a fix for this here https://github.com/apache/metron/pull/966. To work around that in the REPL, you can just do something like the following to test your Profiler definition; basically don't use assignment. [Stellar]>>> conf := SHELL_EDIT(conf)
{
"profiles":[
{
"profile":"demo_iplogon_failed",
"foreach":"ip_address",
"onlyif":"source.type == 'demo_windowsnxlog' and event_id == 4625",
"init":{
"count":"0"
},
"update":{
"count":"count + 1"
},
"result":{
"profile":"count",
"triage":{
"logon_failed_count":"count"
}
}
}
]
}
[Stellar]>>>
[Stellar]>>> PROFILER_INIT(conf)
The issue with the profile definition, is that you don't have a 'result/profile' expression. The 'result/profile' expression which persists the data in HBase is required. Just add one like so below. [Stellar]>>> conf
{
"profiles":[
{
"profile":"demo_iplogon_failed",
"foreach":"ip_address",
"onlyif":"source.type == 'demo_windowsnxlog' and event_id == 4625",
"init":{
"count":"0"
},
"update":{
"count":"count + 1"
},
"result":{
"profile":"count",
"triage":{
"logon_failed_count":"count"
}
}
}
]
}
[Stellar]>>> PROFILER_INIT(conf)
Profiler{1 profile(s), 0 messages(s), 0 route(s)}
... View more
