Deleting search criteria

You can delete search criteria.

About this task

When you delete a saved search, then objects that are associated with the saved search might not function. Reports and anomaly detection rules are QRadar® objects that use saved search criteria. After you delete a saved search, edit the associated objects to ensure that they continue to function.

Procedure

  1. Choose one of the following options:
    • Click the Log Activity tab.
    • Click the Network Activity tab.
  2. From the Search list box, select New Search or Edit Search.
  3. In the Saved Searches pane, select a saved search from the Available Saved Searches list box.
  4. Click Delete.
    • If the saved search criteria is not associated with other QRadar objects, a confirmation window is displayed.
    • If the saved search criteria is associated with other objects, the Delete Saved Search window is displayed. The window lists objects that are associated with the saved search that you want to delete. Note the associated objects.
  5. Click OK.
  6. Choose one of the following options:
    • Click OK to proceed.
    • Click Cancel to close the Delete Saved Search window.

What to do next

If the saved search criteria was associated with other QRadar objects, access the associated objects that you noted and edit the objects to remove or replace the association with the deleted saved search.