Copying and removing log sources
You can copy a log source to one or more groups to suit your organizational needs. When you no longer need a log source in a particular group, you can remove it. Removing a log source from a group does not delete the log source from IBM® QRadar®.
- Click the Admin tab.
- In the Data Sources section, click Log Source Groups.
- From the navigation tree, select the relevant log source group.
- To copy the log source, complete the following steps:
- In the Group Content window, select the relevant log source and click Copy.
- In the Choose Group window, select the group that you want to copy the log source to, and click Assign Groups.
- To remove the log source, complete the following steps:
- In the Group Content window, select the relevant log source and click Remove.
- In the Confirmation window, click OK.