Viewing and finding records in the context table

To view a list of context table records:

1. Go to the full list of context tables or to the list of context tables of a specific correlator.
2. In the Name column, select the relevant context table.

   The list of records for the selected context table is displayed.

   To search the table, in the Search field, enter the value of a record key or the value of a field. The list of context table records displays only the records that contain the entered characters.

   If the your search query matches records with empty key values, the text <Nothing found> is displayed in the widget on the Dashboard. We recommend clarifying the conditions of your search query.

The list of records contains the following data:

• Key is the composite key of the record. It is comprised by one or more values of key fields, separated by the "|" character. If one of the key field values is absent, the separator character is still displayed.

  For example, a record key consists of three fields: DestinationAddress, DestinationPort, and SourceUserName. If the last two fields do not contain values, the record key is displayed as follows: 43.65.76.98| | .

• Record repetitions is the total number of times the record was mentioned in events and identical records were downloaded when importing context tables to KUMA.
• Expiration date – date and time when the record must be deleted. The date and time format depends on the selected application interface language:
  • Russian: DD.MM.YYYY HH:MM:SS, for example: 18.02.2025 16:09:58
  • English: YYYY-MM-DD HH:MM:SS, for example: 2025.02.18 16:09:58

  If the Expires field had the value of 0 when the context table was created, the records of this context table are retained for 36,000 days (approximately 100 years).

• Updated—date and time of the last update of the context table.

Page top