on Jan 15, 2020Article Content
| Article Number | 000038336 |
| Applies To | RSA Product Set: NetWitness Platform RSA Product/Service Type: Investigation from Broker RSA Version/Condition: 11.3.x.x Platform: CentOS O/S Version: 7 |
| Issue | When doing an investigation, You might get the "Unable to build visualization" when selecting a Broker to investigate from, similar to below. |
| Tasks | This error is caused when the parameter "max.query.memory" on Broker is set to lower value than the concentrators of which are being aggregated from.   |
| Resolution | Increase the "max.query.memory" on Broker to a close or matching value that of the Concentrator. In this example we change it to "5 GB", using the following method: On Affected Broker , select "view" > "Explore" > "sdk" > "config" , then change "max.query.memory" to 5 GB, similar to example below:  Now, if we try to investigate directly from Broker, we should no longer see the error:  |