- Scheduled reports on AQL searches can show incorrect column name and column data
- AQL-based reports does not show calculated value
- Reports generating with duplicated column and incorrect column data
(AVG(magnitude) - MIN(magnitude)) AS MAGDIFF
LONG(SUM(eventcount) / ((MAX(endtime) -min(starttime) +1)
REFERENCEMAP('Refname',username) as 'qradaruser',
REFERENCETABLE('reftable','user', LOWER(username)) as 'qradaruser',
Sourceip, destionationip that contains superflows
Diagnosing The Problem
User interface issues
Users who attempt to configure a Time Series graph for search can see calculated values treated as individual data entries in the user interface.
Search results incorrect
The Time Series graph cannot calculate the AQL used in the query, so the data displays 0.0 EPS, even though the table displays the correct EPS. Graph data is based on accumulations, which cannot be calculations or lookup functions by design.
Resolving The Problem
Administrators can review the parameters of the AQL query that is used in the search or report when a graph does not display properly. The AQL parameters listed in this article must be excluded from the AQL query to display in reports and time series graphs in the user interface. The accumulator was not designed to calculate and aggregate data from static functions.
To subscribe to this issue, review APAR IJ25142.
24 June 2020