IBM Support

QRadar: An AQL query can fail if a field type isn’t set correctly, resulting in an error such as "Expression value is not a number"

Troubleshooting


Problem

AQL query might not give result while executing from log activity in Advanced search due to errors in /var/log/qradar.log "Expression 'value' is not a Number" 

The purpose of this article is to help the administrators to efficiently execute the AQL query from Advanced Search in the log activity tab.

Symptom

The following symptoms can be seen while running an advanced search in UI when the issue occurs:
image-20250713135514-1

Errors similar to following logs are displayed in /var/log/qradar.log containing "Expression 'value' is not a Number" message :

Jun 25 02:47:48 ::ffff:X.X.X.X [ariel_proxy.ariel_proxy_server] [ariel_client /x.x.x.x:35142] com.q1labs.ariel.ql.parser.Parser: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]Expression "Value" is not a Number

Jun 25 02:47:48 ::ffff:X.X.X.X [ariel_proxy.ariel_proxy_server] [ariel_client /x.x.x.x:35142] com.q1labs.ariel.ql.parser.AQLParserException: Expression "Value" is not a Number

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0.0;7.1.0;7.2.0;7.2.2;7.2.3;7.2.4;7.2.5;7.2.6;7.2.7;7.2.8;7.3.0;7.3.1;7.3.2;7.3.3;7.4.0;7.4.1;7.4.2;7.4.3;7.5.0"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
24 July 2025

UID

ibm17238125

Page Feedback