Incomplete Report Results

After you configure and run JSA reports, you might see unexpected results. A report might seem like it does not display all the data that you require.

Data accumulation for a search starts only when the search is added to a scheduled report. For example, a report that is created on Wednesday and is scheduled to run every Monday does not display data for a full week. However, the next report contains data for the full week.

Try one of these solutions:

• Run the search again.--Use the Network, Activity, or Log Activity tab to run the search again. You can compare the results with the generated report.

• Review the notification message on the Reports tab.--The Reports tab displays a notification message when your data is incomplete.

• Run your report against raw data from the initial time period.--Ensure that you capture all the report data by running your report against the raw data from the initial time period. For more information, see Juniper Secure Analytics Users Guide.

Incomplete reports also occur when the system is unable to accumulate data aggregations within a 60-second interval. Every minute, JSA creates data aggregations for each aggregated search. If the search counts and unique values in the searches are too large, the time that is required to process the aggregations might exceed 60 seconds. When the accumulation is unable to finish within 60 seconds, the accumulation interval is dropped. Time-series graphs and reports might be missing columns for the time period when the problem occurred. For more information, see Accumulator cannot read the view definition for aggregate data.