Exporting content for single custom property

You can use the content management tool script to export content for each custom property that is created from the Properties tab in the DSM Editor.

About this task

When you use the DSM Editor to create custom properties, a customproperty entity is produced for each custom property that is created.

1. Use SSH to log in to QRadar as the root user.
2. To search for specific content to export, type the following command:

   ./contentManagement.pl -a search -c [content_type] -r [regex]

   For example, to search for the content of a custom property, type the following command:

   /opt/qradar/bin/contentManagement.pl -a search -c 6 -r 
   "<name_of_custom_property>"

3. To export a custom property content, type the following command:

   /opt/qradar/bin/contentManagement.pl -a export -c [content_type] 
   -i [content_identifier]