Article Number | 000038336 |
Applies To | RSA Product Set: NetWitness Platform RSA Product/Service Type: Investigation from Broker RSA Version/Condition: 11.3.x.x Platform: CentOS O/S Version: 7 |
Issue | When doing an investigation, You might get the "Unable to build visualization" when selecting a Broker to investigate from, similar to below.
 |
Tasks | This error is caused when the parameter "max.query.memory" on Broker is set to lower value than the concentrators of which are being aggregated from.

 |
Resolution | Increase the "max.query.memory" on Broker to a close or matching value that of the Concentrator. In this example we change it to "5 GB", using the following method:
On Affected Broker , select "view" > "Explore" > "sdk" > "config" , then change "max.query.memory" to 5 GB, similar to example below:

Now, if we try to investigate directly from Broker, we should no longer see the error:

|