Editing bulk log sources
In the QRadar® Log Source Management app, view and edit a number of log sources at the same time. You can edit the parameters of up to 1000 log sources at one time. Edit multiple log sources when the log sources have similar parameters that you want to change, instead of editing each log source individually.
If you are using QRadar V7.3.1 to V7.3.3, you can also edit bulk log sources by using the Log Sources icon.
In QRadar 7.5.0 Update Package 4 and later, when you click the Log Sources icon, the QRadar Log Source Management app opens.
Before you begin
- In the QRadar Log Source Management app, select the relevant log sources that you want to edit.
- Click Edit.
- In the Log Source Summary pane, select and edit the parameters and
click Save. Restriction: You cannot edit the Log Source Identifier parameter in bulk.
- In the Name Template and Description Template fields, use the available variables to create the names and descriptions of the selected log sources.
- Click the Protocol tab to edit the protocol parameters for the selected log sources. The selected log sources must share a protocol.
- Click Save.