000036021 - "Error occurred while validating query syntax" is displayed when running rules with empty lists that are used but not quoted in RSA Security Analytics

Document created by RSA Customer Support Employee on Feb 23, 2018Last modified by RSA Customer Support Employee on Mar 7, 2019
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000036021
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Reporting Engine, Security Analytics UI
RSA Version/Condition: 10.6.x
Platform: CentOS
O/S Version: EL6
IssueWhen you execute a rule with list values that are not quoted  the rule execution fails with the following ambiguous error message:
"Error occurred while validating query syntax"

User-added image
ResolutionTo get this error fixed please quote the list values, navigate to:

  1. Security Analytics menu, click Administration > Reports. (The Manage tab is displayed.)
  2. Click Lists. (The List view is displayed.)
  3. In the List toolbar, click Edit. (The Build List view tab is displayed.)
  4. The following figure shows the Build List view: User-added image
  • Check the column: Quotes will be inserted for all values