Custom Field Dashboard Query Failing with "invalid argument" Error

Question

Hello Google SecOps Community,I am facing an issue with a dashboard query that retrieves custom field values from SOAR cases.The dashboard was working correctly until last week, and no changes were made to the query. However, it has recently started failing with the following error:“compilation error query uses a feature that is not yet allowed: invalid argument” The error occurs specifically when querying custom field values. The same dashboard and query were previously returning results without any issues.I've already verified:No changes were made to the dashboard query.	The custom fields still exist and contain data.	The issue started suddenly after the dashboard had been functioning normally.Has anyone else experienced a similar issue recently? Is there a known change, limitation, or update related to custom field queries that could cause previously working queries to fail with an "invalid argument" error?Any guidance or recommendations would be greatly appreciated.Thank you!

a_aleinikov · Answer

Hi Victor,This looks less like a custom field data issue and more like a backend/query permission issue.The error “query uses a feature that is not yet allowed” usually means the query engine is blocking part of the custom field query, even if the dashboard was working before.I would test with the simplest possible query against only one custom field. If that also fails, I’d open a Google SecOps support case and include the exact error, the dashboard name, the sanitized query, the custom field name/type, and the date it stopped working.Since this started without any query changes, it may need Google SecOps support to review from the backend side.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded