Troubleshooting
Problem
Customers may experience the following message when modifying and updating the parameters of a Search:
"There was a problem performing the query . please try again..."
Symptom
The following messages are visible in the /var/log/qradar.error log file.
[tomcat.tomcat] [username@xxx.xxx.xx.x (2671) /console/do/ariel/arielSearch] com.q1labs.ariel.ui.UIArielServices: [ERROR] [NOT:0000003000][xxx.xxx.xx.xxx/- -] [-/- -]Error performing ariel query
[tomcat.tomcat] [username@xxx.xxx.xx.x (2671) /console/do/ariel/arielSearch] java.lang.RuntimeException: java.lang.RuntimeException: Error processing criteria
[tomcat.tomcat] [username@xxx.xxx.xx.x (2671) /console/do/ariel/arielSearch] at com.q1labs.ariel.ui.bean.ArielSearchForm.toQueryParams(ArielSearchForm.java:1035)
(..)
/console/do/ariel/arielSearch] Caused by:
[tomcat.tomcat] [username@xxx.xxx.xx.x (2671) /console/do/ariel/arielSearch] java.lang.RuntimeException: Error processing criteria
[tomcat.tomcat] [username@xxx.xxx.xx.x (2671) /console/do/ariel/arielSearch] at com.q1labs.cve.utils.CriteriaBuilder.getCriteria(CriteriaBuilder.java:1522)
(..)
[tomcat.tomcat] [username@xxx.xxx.xx.x (2671) /console/do/ariel/arielSearch] Caused by:
[tomcat.tomcat] [username@xxx.xxx.xx.x (2671) /console/do/ariel/arielSearch] java.lang.IllegalArgumentException: Operation Select is not valid. Should be one of [EQ, LT, LE, GT, GE, NEQ]
[NOT:0000003000][xxx.xxx.xx.xxx/- -] [-/- -]Error executing generic list
[tomcat.tomcat] [username@xxx.xxx.xx.x (2671) /console/do/ariel/arielSearch] java.lang.ClassCastException: com.q1labs.core.ui.coreservices.struts2.ResultSetListForm incompatible with com.q1labs.core.ui.coreservices.struts2.GenericListForm
Cause
This issue is caused by Custom Event Properties not containing a Property Name.
Resolving The Problem
- Login to your QRadar Console.
- Click on the Admin Tab.
- Click on Custom Event Properties.
- Select the Custom Event Properties that do not contain a Property Name and then click Delete.
Result:
After deleting all the Custom Event Properties, users can edit and modify previously executed searches.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt8AAA","label":"Ariel"},{"code":"a8m0z000000cwtEAAQ","label":"Log Activity"}],"ARM Case Number":"TS014856438","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
30 April 2024
UID
ibm17149599