IBM Support

IJ08219: INCOMPLETE RESULTS IN REPORTS WHEN SELECTING 'DAY OF THE WEEK' TARGETED DATA SELECTION CONTAINER DETAILS

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as suggestion for future release.

Error description

  • It has been identified that there can be incomplete or
    inconsistent results in reports when day of the Week is
    selected under the Targeted Data Selection in the container
    details of the report.
    
    For example:
    QRadar Log Activity tab - create a new search A for which data
    is not being accumulated (i.e. without the Group by clause)
    
    Reports Tab - create a new monthly report based on the search
    A. In the Container details of the report, check the Targeted
    Data Selection checkbox. Then select day of the week (e.g.
    Saturday and Sunday)
    Select Tables in the Graph Type dropdown box. Select 65,000 in
    the Limit Events/Logs to Top dropdown box.
    
    Run the report. Verify the records in the report.
    
    Expected Result : The report should contain records for all the
    Saturdays and Sundays of the previous month.
    Actual Result: The report contains only records for the last
    Sunday of the month.
    

Local fix

  • Instead of selecting the day of the week under the Targeted
    Data Selection in the container details of the Report, if the
    day of the week parameter is included in the AQL query of the
    search, the completed report contains all the expected results
    for the day of the week specified in the AQL Query.
    

Problem summary

Problem conclusion

Temporary fix

Comments

  • Please use this workaround: Instead of selecting the day of the
    week under the Targeted Data Selection in the container details
    of the Report, if the day of the week parameter is included in
    the AQL query of the search, then the report contains all the
    records for the day of the week specified in the AQL Query.
    

APAR Information

  • APAR number

    IJ08219

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    728

  • Status

    CLOSED SUG

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2018-08-03

  • Closed date

    2019-06-11

  • Last modified date

    2019-06-11

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"728","Edition":""}]

Document Information

Modified date:
11 June 2019