|Applies To||RSA Product Set: RSA NetWitness Platform|
RSA Product/Service Type: Reporting Engine
RSA Version/Condition: 184.108.40.206
O/S Version: 7
|Issue||When Report ran with lookup_and_add rule action using Reporting: NWDB Rule Syntax document, The report fails with the below error.|
|Cause||This issue is due to one of the data sources of broker does not have real-time data. lookup_and_add rule action iterates through a list of values in a result set and lookup additional metadata. If one datasource offers no values for report duration, that report fails with an error.|
|Workaround||Please Investigate the data source (From error log, 10.10.1.2 concentrator) concentrator why real-time logs are not available.|
This can be verified in ADMIN->Services->Concentrator->Config->General Page.
Once real-time data available in all data sources of Broker, the report runs successfully.