Editing bulk log sources
In the QRadar® Log Source Management app, view and edit a number of log sources at the same time. You can edit the parameters of up to 1000 log sources at one time. Edit multiple log sources when the log sources have similar parameters that you want to change, instead of editing each log source individually.
If you are using QRadar V7.3.1 to V7.3.3, you can also edit bulk log sources by using the Log Sources icon.
In QRadar 7.5.0 Update Package 4 and later, when you click the Log Sources icon, the QRadar Log Source Management app opens.
Before you begin
- In the QRadar Log Source Management app, select the relevant log sources that you want to edit.
- Click Edit.
- In the Log Source Summary pane, select and edit the parameters and
click Save. Restriction: The Log Source Identifier, Log Source Type and Protocol Configuration parameters cannot be edited in bulk in the QRadar Log Source Management app. To edit the Log Source Type parameter in bulk by using the API, see QRadar: How to change log source type in bulk by using the QRadar API.
- In the Name Template and Description Template fields, use the available variables to create the names and descriptions of the selected log sources.
- Click the Protocol tab to edit the protocol parameters for the selected log sources. The selected log sources must share a protocol.
- Click Save.