Examples of log source extensions on QRadar Support Forums

You can create log source extensions (LSX) for log sources that don't have a supported DSM. To help you create your own log source extensions (also known as DSM extensions), you modify existing ones that were created.

The IBM® QRadar® Support Forum is an online discussion site where users and subject matter experts collaborate and share information.

You can find examples and answers to administration or troubleshooting questions that are related to the DSM Editor, log source extensions, and custom parsing issues on IBM QRadar Support Forum (https://www.ibm.com/mysupport/s/forumsproduct?language=en_US&name=qradar-dsm-editor&id=0TO0z000000R0iKGAS).

Optionally, for administration or troubleshooting questions that are related to the DSM Editor, log source extensions, and custom parsing issues, you can go to IBM QRadar FORUMS 101 (https://www.ibm.com/community/qradar/home/forums/). From the Category list, select Events and Log Sources, and from the Tag list, select qradar-dsm-editor.