"Entity checksum.all has a non-matching index level for referenced key checksum.src" error occurred when query in investigate Event

[#1]

Article Number

000039735

Applies To

RSA Product Set: RSA NetWitness Platform
RSA Version/Condition: 11.4.x, 11.5.x, 11.6.x
Platform: Centos
O/S Version: Centos 7
Product Description: RSA NetWitness Logs & Network

Issue

User cannot query anything in Investigate Events view.  Each query item, regardless of the query, displays "Entity checksum.all has a non-matching index level for referenced key checksum.src". 

Image description

Cause

checksum.all is an entity in the concentrator and it includes the following keys in index-concentrator.xml.

 

<entity description="All Checksum Keys" name="checksum.all">
 <keyref name="checksum"/>
 <keyref name="checksum.src"/>
 <keyref name="checksum.dst"/>
 </entity>

We recommend that all the keys in the entity should be indexed at the same level. If not, this issue would occur.

For example, checksum.src and checksum.dst are indexed as "IndexValues" in index-concentrator.xml, but checksum is indexed as "Indexkeys" in index-concentrator-custom.xml.
In this case, the index level of checksum should be changed to "IndexValues"
 

<key description="Source Checksum" name="checksum.src" format="Text" level="IndexValues" valueMax="20000000"/>
<key description="Target Checksum" name="checksum.dst" format="Text" level="IndexValues" valueMax="20000000"/>

<key description="Checksum" name="checksum" format="Text" level="Indexkeys"/>

 

Resolution

Note: In broker index, no changes are required. Change the index-concentrator-custom.xml in all concentrators connected to the broker.

1. Modify the index level of checksum, checksum.src or checksum.dst in index-concentrator-custom.xml file.
2. After changing, either of the following steps can be performed.

Option #1 : Restart the concentrator service.

Option #2 (Recommended) : Navigate to Explore page of the concentrator. Right click "index" node and click "properties". Select "save" from dropdown and click send. This should make the changed index effective. 

This should resolve the error: "Entity checksum.all has a non-matching index level for referenced key checksum.src"