Hi,

I am getting below error after created new weekly automated report. Please help to resolve it.

[rootSupport Member~]# grep ReportServices /var/log/qradar.error | less

Feb 7 00:03:26 ::ffff:x.x.x.x [report_runner] [main] com.q1labs.reporting.ReportServices: [WARN] [NOT:0000004000][x.x.x.x/- -] [-/- -]Report `R2L IPS detection' for user `<username>' falls back to raw data: requested Sort order:<DisplayValueComparator[com.q1labs.core.types.formatters.BinaryStringFormatterSupport Member],desc> is not in aggregated properties

Feb 7 05:39:28 ::ffff:x.x.x.x [report_runner] [main] com.q1labs.reporting.ReportServices: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]REPORT [WEEKLY#^#<username>#$#76771d4b-e416-41c6-9925-6d52cb3ba45a#^#1644230367572]: Report Exception: <username>#$#76771d4b-e416-41c6-9925-6d52cb3ba45a.xml

Feb 7 06:44:18 ::ffff:x.x.x.x [report_runner] [main] com.q1labs.reporting.ReportServices: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]REPORT [WEEKLY#^#<username>#$#3e1fbce3-4a40-4ece-b663-f29f413fcb74#^#1644234257298]: Report Exception: <username>#$#3e1fbce3-4a40-4ece-b663-f29f413fcb74.xml

Feb 7 07:03:05 ::ffff:x.x.x.x [report_runner] [main] com.q1labs.reporting.ReportServices: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]REPORT [WEEKLY#^#<username>#$#3e1fbce3-4a40-4ece-b663-f29f413fcb74#^#1644235384211]: Report Exception: <username>#$#3e1fbce3-4a40-4ece-b663-f29f413fcb74.xml

Feb 7 08:24:36 ::ffff:x.x.x.x [report_runner] [main] com.q1labs.reporting.ReportServices: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]REPORT [WEEKLY#^#<username>#$#91d88351-bb07-4605-9b05-8db807cc307a#^#1644240275230]: Report Exception: <username>#$#91d88351-bb07-4605-9b05-8db807cc307a.xml

Thanks

Hi,

Please make sure that you have an aggregated property (i.e. group by clause) in the saved search. If it doesn't then the aggregation will not happen and eventually the report will fall back to the raw data.

Hope it helps.

Also, please make sure if the field where you applying desc (sorting) is sortable or not.