Hello,

I am exporting the data from collector (Manage -> Data Export) successfully. Then I am importing it on aggregator ( Manage -> Data Import) successfully.

But still I can't find any data on aggregator. Therefore I am not able to generate any aggregated reports.

I would request that if anyone could help me to understand if I am missing something or what is the right way to do it.
If any troubleshooting is required. 

I have also went through the video Best practices of aggregator on IBM security learning academy but unable to find any solution.

Therefore, I am kind of  stuck here any help is highly appreciated.

Thanks and Regards,
Ved Gaurav

------------------------------
Ved Gaurav
------------------------------

Hi,

Please check the Aggregation/Archive logs, is the data successfully import and export on both Aggregator and Collector. Also, ensure the Schedule define correctly as well.

Any error message when try to generate the report?

------------------------------
TS Teh
------------------------------

Hi, 

Facing the same issue with reporting,   
Alternate, you can create an AUDIT PROCESS and Run the required report for duration and you will get all the required results. 


------------------------------
Muhammad Tehseen
------------------------------

Hi Ved,

If it is confirmed there is no error/exception for the import/export in Aggregation/Archive logs, you can try to disable the option "Partition optimization" in the query of the report. Refer to https://www.ibm.com/docs/en/guardium/10.5?topic=reports-queries. Hope it helps.


------------------------------
Jonathan LU
Security Support Engineer
IBM
------------------------------