none
Message Analyzer does not decode fields defined with valueMap

    Question

  • I have manifest with template that use valueMap field.
    When open collected trace in Message Analyzer I see all fields that have map="..." output are still shown as numbers.

    When I convert etl to evtx with:
    wevtutil epl my_log.etl my_log.evtx /lf:true
    and open it with event viewer I see correctly mapped strings.

    I also checked how the fields are decoded in automatically generated opn file and also do not see the mapping.

    Wednesday, June 11, 2014 3:59 PM

Answers

  • This is a known issue that we hope to address in the next public release. The fix specifically addresses INTS that have strings as mapped names.  If this is not your scenario, please let me know.

    Paul

    • Marked as answer by Paul E Long Friday, June 13, 2014 1:23 PM
    Friday, June 13, 2014 1:23 PM

All replies

  • This is a known issue that we hope to address in the next public release. The fix specifically addresses INTS that have strings as mapped names.  If this is not your scenario, please let me know.

    Paul

    • Marked as answer by Paul E Long Friday, June 13, 2014 1:23 PM
    Friday, June 13, 2014 1:23 PM
  • I have the same problem as described below.

    Was this issue addressed?

    If yes, any special configuration to perform?

    If no, when will this be addressed or any workaround?

    This issue makes the tool unfriendly a bit, since the trace needs to be interpreted by the user itself every time and cumbersome to read for example while translating protocol fields.

    Thanks in advance for your answer.

    /Michael



    • Edited by m1977 Saturday, August 16, 2014 9:13 PM
    Saturday, August 16, 2014 8:55 PM
  • I'm using MessageAnalyzer 1.1 and see the issue is not fully-fixed.
    Summary field still contains undecoded numbers, while decoded field values are shown in Details:

    Summary:
    '0_22: Pin disconnected - output buffer left enabled'

    Details:
    Name:'BankNo', Value:'GPP_A(0) (0x00000000)', Type:'GPIO2_BankName', ...
    Name:'PinNo', Value:'22 (0x00000016)', Type:'UInt32', ....

    After converting to evtx with:
    wevtutil epl my_log.etl my_log.evtx /lf:true

    the Message Analyzer shows the message decoded:
    'GPP_A_22: Pin disconnected - output buffer left enabled'


    • Edited by MitekPL Tuesday, October 7, 2014 8:33 AM new findings
    Tuesday, October 7, 2014 8:21 AM
  • Version 1.4, issue still not fixed.
    Tuesday, February 7, 2017 6:04 PM