000038336 - Unable to build visualization on Broker in RSA NetWitness Platform

Document created by RSA Customer Support Employee on Jan 15, 2020
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000038336
Applies ToRSA Product Set: NetWitness Platform
RSA Product/Service Type: Investigation from Broker
RSA Version/Condition: 11.3.x.x
Platform: CentOS
O/S Version: 7
IssueWhen doing an investigation, You might get the "Unable to build visualization" when selecting a Broker to investigate from, similar to below.

User-added image
TasksThis error is caused when the parameter "max.query.memory" on Broker is set to lower value than the concentrators of which are being aggregated from. 
User-added image

User-added image
ResolutionIncrease the "max.query.memory" on Broker to a close or matching value that of the Concentrator. In this example we change it to "5 GB", using the following method:

On Affected Broker , select "view" > "Explore" > "sdk" > "config" , then change "max.query.memory" to 5 GB, similar to example below:

User-added image

Now, if we try to investigate directly from Broker, we should no longer see the error:

User-added image