000030385 - Executing a free text content search against a Broker fails to return results in RSA Security Analytics 10.4

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000030385
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI, Broker, Concentrator, Archiver
RSA Version/Condition: 10.4.x
Platform: CentOS
O/S Version: EL6
IssueExecuting a free text content search on against a Broker fails to return results in RSA Security Analytics 10.4.
CauseA new feature known as msearch, which is used for raw text searches, is included on core devices--as well as the Archiver--at version 10.4.x.  However, this feature is not available for devices at previous versions.
Therefore, executing such a source against a Broker that has aggregate devices at earlier versions will not return any results.
ResolutionIn order to get results from free text searches against a Broker, ensure that its aggregate devices are at version 10.4.x or above.

Attachments

    Outcomes