IBM Support

IV81172: PIE AND BAR CHART REPORTS CONTAINING ADVANCED SEARCH RESULTS WITH 'ASSETHOSTNAME' SET AS THE X AXIS CAN FAIL

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • QRadar User Interface, Reports tab:
    When attempting to generate a Pie chart or a Bar chart with
    'AssetHostName' set as the Horizontal (X) Axis, and that is
    based on an AQL query (Advanced Search), and using the AQL
    function "AssetHostname", an SQL exception occurs and the
    report generation fails.
    
    Messages similar to the following might be visible in
    /var/log/qradar.log when this issue is occurring:
    
    [report_runner] [main] com.q1labs.reporting.ReportServices:
    [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]Unexpected error
    [report_runner] [main] java.sql.SQLException: ResultSet object
    does not contain column
    "assethostname_destinationip_1452615717123_null"
    [report_runner] [main] at
    com.q1labs.cve.resultset.CVEResultSet.findColumn(CVEResultSet.ja
    va:313)
    [report_runner] [main] at
    com.q1labs.cve.resultset.CVEResultSet.getLabel(CVEResultSet.java
    :495)
    [report_runner] [main] at
    com.q1labs.reporting.charts.ArielChart.processResultSet(ArielCha
    rt.java:882)
    [report_runner] [main] at
    com.q1labs.reporting.charts.ArielChart.getData(ArielChart.java:1
    667)
    [report_runner] [main] at
    com.q1labs.reporting.Chart.getXML(Chart.java:218)
    [report_runner] [main] at
    com.q1labs.reporting.Report.createData(Report.java:237)
    [report_runner] [main] at
    com.q1labs.reporting.Report.process(Report.java:297)
    [report_runner] [main] at
    com.q1labs.reporting.ReportRunner.main(ReportRunner.java:242)
    [report_runner] [main] com.q1labs.reporting.ReportServices:
    [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]Unexpected error
    

Local fix

  • Select Table or Bar (X-Axis set to time attribute) graph type
    for the report, instead of Pie or Bar Chart with X-Axis set to
    asset attribute.
    

Problem summary

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8
    

Problem conclusion

  • This issue was resolved with QRadar/QRM/QVM/QRIF 7.2.8
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV81172

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    726

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-02-04

  • Closed date

    2016-09-28

  • Last modified date

    2016-09-28

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

  • R728 PSY

       UP

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"726","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
28 September 2016