|Applies To||RSA Product Set: Security Analytics|
RSA Product/Service Type: Reporting Engine, Data Warehouse (SAW)
O/S Version: EL6
While running an report on the Warehouse, the following error is displayed:
DataSourceSAW.Query Execute failed,Execution
|Cause||This error occurs when the report is run from the /logs directory rather than the /sessions directory. The /logs directory in the warehouse stores the raw logs and the /sessions stores the actual meta.|
|Resolution||Unless raw_log is used in the Select field to query for the raw logs, select the /sessions option for the From value on the Build Rule page as shown below.|
For more information on writing rules, please refer to the sample rules in the Security Analytics User Guide for your version of the product.