000030383 - Indexed values are showing as Not Indexed during investigations in RSA Security Analytics 10.4.x

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000030383
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI
RSA Version/Condition: 10.4.x
Platform: CentOS
O/S Version: EL6
IssueWhen an index level of a meta key used in a custom meta group is changed on any core device (via the custom index xml file), it may cause an investigation of another core device to use the incorrect index level for that meta key.
When a user is querying data using a custom meta group, this issue may be visible in the Navigate view and in the Manage Meta Groups dialog box.
In the Navigate view, a meta key that is expected to be indexed may be labeled as Not Indexed and cannot be opened. The non-indexed meta key may take longer to load as a result.
User-added image
The following message may be displayed next to an Open meta key in the Manage Meta Groups dialog:  Not Indexed; will experience longer than usual load times. 
WorkaroundThe issue can be worked around by logging out then back into the Security Analytics UI.  This issue is only seen when custom meta is in use.