User mighh have a weekly report where the data is only displayed in raw mode, as soon as we schedule the repoort, no data is displayed.

When we see from the Global view, the data is not getting populated, but in reality we might see data with normal search.

cd /store/ariel/gv/GV_10386/2024/2/

[root@jsa]# ls
10 11 12 13 14 7 8 9

[root@jsa]# du -sh * | sort -h
0 10
0 11
0 12
0 14
0 7
0 9
12K 8
20K 13

The issue on blank weekly report was caused by a new known issue on QRadar -- "Scheduled reports fail to generate if the ORDER by clause uses more than one column."

There is currently no resolution to this issue.

The workaround is in the below:

1. Use single column in the ORDER BY clause.

2. If the customer wants more than one column in the ORDER BY clause, then they can enable the weekly and monthly report to fall back to raw data by adding the below property -REPORT_PERFORM_RAW_DATA_CHECK=false to the file /store/configservices/staging/globalconfig/nva.conf and deploy changes. Mind you that this may cause performance issue on your environment.

If you opt for Option 2 of the workaround, you can run this script to add in the REPORT_PERFORM_RAW_DATA_CHECK=false line to /store/configservices/staging/globalconfig/nva.conf and then deploy changes.

# Add line to the end of the file

1. Run: echo "REPORT_PERFORM_RAW_DATA_CHECK=false" >> /store/configservices/staging/globalconfig/nva.conf

2. Go to Admin > Deploy changes.