Why do I get an "invalid identifier" SQL compilation error when querying for a p_any field?
Last updated: September 3, 2024
Issue
When trying to query a p_any field (such as p_any_ip_addresses) in Panther's Data Explorer, an error similar to the following occurs:
ErrorMessage=SQL compilation error: error line 6 at position 42 invalid identifier 'P_ANY_IP_ADDRESSES'
Resolution
Make sure you are querying a record that exists for that log type.
Cause
This issue occurs when you try to query a field on a log type that does not record that information. For example, if you attempt to query p_any_ip_addresses on a log type that does not record IP addresses.