000032514 - RSA Security Analytics Reporting Engine unable to run a rule against Warehouse DB with an error "At least one column must be specified for the table"

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Jan 23, 2018
Version 11Show Document
  • View in full screen mode

Article Content

Article Number000032514
Applies ToRSA Product Set:  Security Analytics
RSA Product/Service Type:  Reporting Engine, Data Warehouse (SAW)
Platform:  CentOS
O/S Version:  EL6
While running an report on the Warehouse, the following error is displayed:


DataSourceSAW.Query Execute failed,Execution
Error:return code 1 from
org.apache.hadoop.hive.ql.metadata.HiveException: at
least one column must be specified for the table


CauseThis error occurs when the report is run from the /logs directory rather than the /sessions directory.  The /logs directory in the warehouse stores the raw logs and the /sessions stores the actual meta.
ResolutionUnless raw_log is used in the Select field to query for the raw logs, select the /sessions option for the From value on the Build Rule page as shown below.
User-added image

For more information on writing rules, please refer to the sample rules in the Security Analytics User Guide for your version of the product.