Skip to content
  • There are no suggestions because the search field is empty.

Unable to build visualization on Broker in RSA NetWitness Platform

Issue

When doing an investigation, You might get the " Unable to build visualization" when selecting a Broker to investigate from, similar to below.

User-added

Tasks

This error is caused when the parameter " max.query.memory" on Broker is set to lower value than the concentrators of which are being aggregated from. 
User-added




User-added

Resolution

Increase the "max.query.memory" on Broker to a close or matching value that of the Concentrator. In this example we change it to "5 GB", using the following method:

On Affected Broker , select "view" > "Explore" > "sdk" > "config" , then change "max.query.memory" to 5 GB, similar to example below:

User-added


Now, if we try to investigate directly from Broker, we should no longer see the error:

User-added



Product Details

RSA Product Set: NetWitness Platform
RSA Product/Service Type: Investigation from  Broker
RSA Version/Condition: 11.3.x.x
Platform: CentOS
O/S Version: 7

Summary

Getting Unable to build visualization on broker while trying to investigate from Broker.


Approval Reviewer Queue

RSA NetWitness Suite Approval Queue