Removing a log source group

You can remove a log source group that contains log sources. If any content, such as rules or saved searches, depends on the log source group it cannot be deleted.

About this task

Removing a log source group does not delete the log sources from IBM® QRadar®.

Procedure

  1. Click the Admin tab.
  2. In the Data Sources section, click Log Source Groups.
  3. From the navigation tree, select the group that contains the group you want to remove.
  4. In the Group Content window, select the group and click Remove.
  5. If the log source group has no dependents, in the Confirm Deletion window, click Delete.
  6. If the log source group has dependents, complete the following steps:
    1. In the Found Dependents window, click View.
    2. Delete or edit the dependents so that they do not reference the log source group. Perform these actions in the relevant areas of QRadar.
    3. In the Unable to delete one or more items window, click Cancel.
    4. Return to step 4.