Query Regarding Creating Multiple Custom Parsers for the Same Log Source

 

I created a custom parser for OCSF and made it active. When I tried to create a new custom parser, I received the message, "A custom parser already exists for this log source. Do you want to inspect that?"

Can I have multiple custom parsers for the same log source, or is it restricted to just one?

harshwardhan16_0-1723797524089.png

 

Any guidance or help would be greatly appreciated.

0 3 260
3 REPLIES 3