Howdy,
We are on 10.6.1 and have been creating rules and alerts (in the reporting engine). We normally pick our hybrid (logs) concentrator as the data source (on the alert). This was working fine...now all of a sudden we get a error message with the below. We do push to decoders, on our alerts.
Anyone know what could of changed? We've tried deleting the rule, alert and app rule yet this message still comes back. Not sure if the Data Source should be our Log Decoder, if that has any performance impact? If so, why havent we gotten this before?
Check the configuration of the Reporting Engine
Administrattion -> Services -> Reporting Engine -> View - Config -> Sources Tab
The decoders ONLY need to be added to be able to use the "push to decoder" function for Alerts. Never select them as the source of a query or report.