Issue

When trying to query a p_any field (such as p_any_ip_addresses) in Panther's Data Explorer, an error similar to the following occurs:

ErrorMessage=SQL compilation error: error line 6 at position 42 invalid identifier 'P_ANY_IP_ADDRESSES'

Resolution

Make sure you are querying a record that exists for that log type.

Cause

This issue occurs when you try to query a field on a log type that does not record that information. For example, if you attempt to query p_any_ip_addresses on a log type that does not record IP addresses.