Collect custom records

Note that the trigger must be created on each sensor (Discover appliance) that you want to collect these types of records from. You can create the trigger on a Command appliance or Reveal(x) 360 to collect your custom records from all connected sensors.

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
2. Click the System Settings icon , and then click Triggers.
3. Click Create.
4. In the Create Trigger pane, complete your information, similar to the following example:

   Name: HTTP 404 Errors

   Description: Track 404 errors on primary web server.

   Enable debug log: Select the checkbox to enable debugging.

   Events: HTTP_RESPONSE

5. Click the Editor tab to write the trigger specifications.
   The following figure shows an example configuration that only collects records when a 404 status code is detected. We also set a name (web404) for these types of records to identify them in a record query and added identifying information for debugging.
   
   
   In the next steps, assign the trigger to a device or device group for which you want to monitor 404 status codes.
6. Click Assets from the top menu.
7. Click Devices and then click the Active Devices chart.
8. Select the checkbox for a device from the list. For our example, we will select a web server called web2-sea.
9. Click the Assign Triggers icon, select the trigger you created in the previous steps, and then click Assign Triggers. In the following figure, we have selected our web server, web2-sea.
   
   After assigning the trigger, return to the System Settings > Trigger page and select the trigger you created. First, make sure your device has activity. Then, click the Debug Log tab to see if the trigger is committing your records. For the following example, we intentionally visited unavailable web pages to generate 404 errors.
   
   

Record formats are the recommended way to display your records with only the fields you want to see. Without a custom record format, the fields for your custom record will not appear in any selectable lists, such as the Group By list.

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
2. Click the System Settings icon and then click Record Formats.
3. Click on the type of record you want to copy. For our example, we will copy the HTTP record format.
4. Copy the contents in the text box below Schema on Read.
5. Click New Record Format.
6. Complete the following fields:

   Display Name: Type a unique name for your record format.

   Author: Identify the author for the record format.

   Record Type: Type the same record type ID you created in the trigger. In our example, this value is web404.

   Schema on Read: Paste the copied contents from step 4 into the text box. Edit the box to delete any unwanted fields. For our example in the figure below, we only kept the following fields: Client, Server, Method, Status Code, URI, and Processing Time.