Exporting QID map entries

View the mappings between the events of external devices and their unique identifiers by exporting your QID entries.

About this task

For QID map entries that you created, use the QID map utility to export the entries to a .txt file.

For an entire QID map that includes the default system QID entries, use the idlist.sh command.

Procedure

  1. Using SSH, log in to IBM QRadar as the root user.
  2. To export the QID map file of user-defined entries, type the following command:

    /opt/qradar/bin/qidmap_cli.sh -e -f <filename.txt>

    The <filename.txt> option is the directory path and name of the file that you want to contain your QID map entries.

  3. To export the entire QID map, type the following command:

    /opt/qradar/bin/idlist.sh -e qid > <filename.txt>

  4. To determine the last modified date of your QID map, run an SQL query.
    For example, if a QID has the identification number 64250088, type the following SQL query to retrieve its last modified date:

    psql -U qradar -c "select qid,to_timestamp(serial/1000) as date from qidmap_serial where qid = 64250088;"