Article Number
000001440
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: Reporting Engine, Data Warehouse (SAW)
Platform: CentOS
O/S Version: EL6
Issue
While running an report on the Warehouse, the following error is displayed:
DataSourceSAW.Query Execute failed,Execution
Error:return code 1 from
org.apache.hadoop.hive.ql.exec.DLLTask.
org.apache.hadoop.hive.ql.metadata.HiveException: at
least one column must be specified for the table
Image description
Cause
This error occurs when the report is run from the /logs directory rather than the /sessions directory. The /logs directory in the warehouse stores the raw logs and the /sessions stores the actual meta.
Resolution
Unless raw_log is used in the Select field to query for the raw logs, select the /sessions option for the From value on the Build Rule page as shown below.
Image description
For more information on writing rules, please refer to the sample rules in the
Security Analytics User Guide for your version of the product.