Exporting all custom content

You use the contentManagement.pl script to export all custom content in your IBM QRadar deployment.

Procedure

  1. Use SSH to log in to QRadar as the root user.
  2. Go to /opt/qradar/bin directory, and type the command to export all of the custom content:
    ./contentManagement.pl -a export -c all 
    Examples:
    • To include accumulated data in the export, type the following command:
      ./contentManagement.pl --action export --content-type all -g
    • To specify the directory for the exported file and change the compression format, type the following command:
      ./contentManagement.pl -a export -c all -o [filepath] -t [compression_type]

Results

The content is exported to a compressed file, for example, all-ContentExport-20151022101803.zip. You can manually change the file name to a name that is more descriptive. The exported file might contain more content items than expected because all dependencies are exported with the specified content items. For example, if you export a report, the saved search that the report uses is also exported.