Change Report Returned Values

[ftavares]

Hi all,

today we have a scheduled Report that runs a SQL query to return some specific data in our Logger.

Now, we have a request to translate some specific returned values to others more user-friendly. Our goal is clarify our customer's understanding about report's content.

So, we have tried to change the QUERY object appending some CASE and WHEN tags, trying to modify our returned value with SQL statements, but, every SQL combination that we have used, did not pass in ArcSight Logger's SQL Validation tool in Logger's Web Interface. It says that SQL Query is wrong every time.

So, we need to accomplish this result, what's the best approach to modify our returned data and deliver our report with those modifications to our customer?

[ftavares · Accepted solution]

Updating this:

the Logger mentioned was the oldest still playing in our farm. The problem was solved after apllying its version update. The construction of report worked well using regular SQL sintax.

Regards,

Fabiano.