Removing a log source group
You can remove a log source group that contains log sources. If any content, such as rules or saved searches, depends on the log source group it cannot be deleted.
Removing a log source group does not delete the log sources from IBM® QRadar®.
About this task
- Click the Admin tab.
- In the Data Sources section, click Log Source Groups.
- From the navigation tree, select the group that contains the group you want to remove.
- In the Group Content window, select the group and click Remove.
- If the log source group has no dependents, in the Confirm Deletion window, click Delete.
- If the log source group has dependents, complete the following steps:
- In the Found Dependents window, click View.
- Delete or edit the dependents so that they do not reference the log source group. Perform these actions in the relevant areas of QRadar.
- In the Unable to delete one or more items window, click Cancel.
- Return to step 4.