Article Number
000031894
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: Archiver
RSA Version/Condition: 10.3.x, 10.4.x
Platform: CentOS
O/S Version: EL6
Issue
Errors similar to the example below are seen when running reports on the Archiver.
There was an unspecified parsing error.
Input(time='2015-Oct-31 18:30:00'-'2015-Nov-02 18:29:59')&&(device.type=symantecav).
Cause
The meta key "device.type" specified in the error message is missing from the index-archiver-custom.xml.
Resolution
Add the meta key "device.type" to the index-archiver-custom.xml and restart the nwarchiver service.
Make sure that aggregation has started before running the report again otherwise you will get an error message about the sdk.
