Troubleshooting Tip: Dataset query error due to database changes in FortiAnalyzer v7.6
| Description | This article provides an example of a dataset query error due to changes in the FortiAnalyzer database from Postgres to ClickHouse. This change will primarily affect the custom dataset query which was scripted according to Postgres-specific queries. |
| Scope | FortiAnalyzer v7.6.0 and onwards. |
| Solution | The dataset queries below will give the following error message for FortiAnalyzer versions 7.6.0 and onwards:
DB::Exception: Incorrect number of arguments for function toString provided 2 (String, String), expected 1 ('Value' ::(While processing toString(formatDateTime(toDateTime(itime), '%Y-%m-%d %H:%i:%s'), 'YYYY-MM-DD Day') AS FullDate,
This is because, as of this day, ClickHouse does not support the to_char function as it replaces it with formatDateTime.
Once the dataset has been updated with the correct syntax, review the dataset and chart result before generating a report. |