Why do I get an "invalid identifier" SQL compilation error when querying for a p_any field?
Issue
When trying to query a p_any
field (such as p_any_ip_addresses
) in Panther's Data Explorer, an error similar to the following occurs:
ErrorMessage=SQL compilation error: error line 6 at position 42 invalid identifier 'P_ANY_IP_ADDRESSES'
Resolution
Make sure you are querying a record that exists for that log type.
Cause
This issue occurs when you try to query a field on a log type that does not record that information. For example, if you attempt to query p_any_ip_addresses
on a log type that does not record IP addresses.