Exporting all custom content of a specific type

You can export all custom content of a specific type in one action.

About this task

The content management script uses text identifiers or numeric identifiers to specify the type of content that you want to export.
Table 1. Content type identifiers for exporting custom content
Custom content type Text identifier Numeric identifier
Dashboards dashboard 4
Reports report 10
Saved searches search 1
FGroups 1 fgroup 12
FGroup types fgrouptype 13
Custom rules customrule 3
Custom properties customproperty 6
Log sources sensordevice 17
Log source types sensordevicetype 24
Log source categories sensordevicecategory 18
Log source extensions deviceextension 16
Reference data collections referencedata 28
Custom QID map entries qidmap 27
Offense Mapper Type offensetype 44
Historical correlation profiles historicalsearch 25
Custom functions custom_function 77
Custom actions custom_action 78
Applications installed_application 100
1An FGroup represents a group of content, such as a log source group, reporting group, or search group.

Procedure

  1. Use SSH to log in to IBM QRadar as the root user.
  2. Go to the /opt/qradar/bin directory and type the command to export all content of the specified type: 
    ./contentManagement.pl -a export --content-type [content_type] --id all
    Parameters:
    Table 2. contentManagement.pl script parameters for exporting custom content of a specific type
    Parameter Description
    -c [content_type]

    or

    --content-type [content_type]

    		 Specifies the type of content.

    You can type the corresponding text or numeric identifier to specify the content type.

    Attention: If you choose to export data of a specific content type, additional data from related content of any content type might be exported.
    -m <DOMAIN>

    --domain <DOMAIN>

    		 Specifies a domain name to export only the reference data associated directly with the specified domain. Any other keys or elements in the reference data collection are excluded. If the domain parameter is not supplied when a reference data collection is exported, all reference data in the collection is exported. In this situation, the reference data is exported under the assumption that the -e/--include-reference-data-elements parameter is provided, independent of the domain association.
    Attention: The domain parameter is relevant only when you export the reference data.
    -e

    or

    --include-reference-data-elements

    		 Set this flag to include reference data keys and elements in the export.

    Reference data keys and reference data elements are applicable to the referencedata content type. This parameter is applicable only when you export reference data, or content items that are dependent on reference data.
    -g

    or

    --global-view

    		 Includes accumulated data in the export.
    -i [content_identifier]

    or

    --id [content_identifier]

    		 Specifies the identifier of a specific instance of custom content such as a single report or a single reference set.

    You can specify all to export all content of the specified type.
    -o [filepath]

    or

    --output-directory [filepath]

    		 Specifies the full path to the directory where the export file is written.

    If no output directory is specified, the content is exported to the current directory. If the specified output directory does not exist, it is created.
    -t [compression_type]

    or

    --compression-type [compression_type]

    		 Specifies the compression type of the export file.

    Valid options are ZIP and TARGZ (case sensitive). If you do not specify a compression type, the default compression type is ZIP.
    Examples:
    • To export all custom searches, type the following command:
      ./contentManagement.pl --action export --content-type search --id all
    • To export all reports and include accumulated data, type the following command:
      ./contentManagement.pl -a export -c 10 --id all --global-view

Results

The content is exported to a compressed file, for example, reports-ContentExport-20151022101803.zip. You can manually change the file name to a name that is more descriptive. The exported file might contain more content items than expected because all dependencies are exported with the specified content items. For example, if you export a report, the saved search that the report uses is also exported.