Hello,
Just in case you or someone else is still struggling with this:
The problem seems to be in the renaming of the event_id / EPOEvents.AutoID column.
I had the same problem and found a solution by wrapping the custom SQL select into another outer select and then using the event_id as the rising_column . This way, the correct "column" name ( event_id ) exists in the original data set and the resulting data set.
I did it like this, you can modify any part if needed. This works for me at least:
SELECT * FROM (
.... the query string from TA_mcafee comes here ...
) as outer_table
{{WHERE $rising_column$ > ?}}
I also needed to disable one of the columns that try to write to the login_user field in the mcafee query, because otherwise the outer SELECT would fail (two inputs for the same field name, login_user). You can see this problem by looking at the mcafee SQL query. I disabled the select row by commenting out the SourceUserName column from the SQL statement, like this:
--[EPOEvents].[SourceUserName] as [logon_user],
This seems to do the trick for me at least.
... View more