000017607 - Reporting rule with lookup_and_add() function leads to no data retrieval on realtime dashlet in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000017607
Applies ToRSA Security Analytics
RSA Security Analytics 10.3.3
RSA Security Analytics Reporting Engine
IssueReporting rule with lookup_and_add() function leads to no data retrieval on realtime dashlet in RSA Security Analytics.
The reporting dashlets on the Unified Dashboard fail to load.
The following error message is displayed:  No Chart Data Available For selected Time Range
All reporting rules are working fine, but "Reporting Realtime Chart" using rules with lookup_and_add() function returns no data.
CauseQueries containing lookup_and_add() take a long time to complete and they are best for offline reports.
ResolutionA permanent fix for this issue has been implemented in RSA Security Analytics 10.4.
NotesSteps to Reproduce:

1. Import the attached rule on RE.
2. Test the rule is correct and working.
3. Create "Reporting Realtime Chart".
4. Check data is loaded or not.
Legacy Article IDa66774

Attachments

    Outcomes