This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
Register Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Knowledge Base
Find answers to your questions and identify resolutions for known issues with knowledge base articles written by NetWitness experts.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

RSA Security Analytics Reporting Engine unable to run a rule against Warehouse DB with an error "At least one column must be specified for the table"

Article Number

000001440

Applies To

RSA Product Set:  Security Analytics
RSA Product/Service Type:  Reporting Engine, Data Warehouse (SAW)
Platform:  CentOS
O/S Version:  EL6

Issue

While running an report on the Warehouse, the following error is displayed:
 

DataSourceSAW.Query Execute failed,Execution
Error:return code 1 from
org.apache.hadoop.hive.ql.exec.DLLTask.
org.apache.hadoop.hive.ql.metadata.HiveException: at
least one column must be specified for the table
 

Cause

This error occurs when the report is run from the /logs directory rather than the /sessions directory.  The /logs directory in the warehouse stores the raw logs and the /sessions stores the actual meta.

Resolution

Unless raw_log is used in the Select field to query for the raw logs, select the /sessions option for the From value on the Build Rule page as shown below.
 
0 Likes
Was this article helpful? Yes No
No ratings

In this article

Version history
Last update:
‎2022-02-10 01:41 PM
Updated by:
Administrator Administrator

Related Content

© 2022 RSA Security LLC or its affiliates. All rights reserved.