IBM Support

IJ00800: "HTTP ERROR 400" ERROR WHEN DRILLING DOWN INTO SEARCH RESULTS USING INTERNET EXPLORER 11 AND EDGE WEB BROWSER

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as Permanent restriction.

Error description

  • It has been identified that after patching to QRadar 7.2.8
    pacth 10 and when using the Internet Explorer 11 (and Edge) web
    browser, an HTTP ERROR 400 popup window appears when attempting
    to drill down into a search with multiple results.
    
    Example of steps that can produce this issue using the Internet
    Explorer or Edge web browser:
    
    1. Navigate to the Log Activity Tab.
    2. Click "Search", then "Edit Search".
    3. Under Time Range, check Recent, then choose "Last 15 Minutes"
    4. Under column definition -> available columns, send "Source
    or Destination IP" to the Group By list by clicking the right
    arrow button.
    5. Click "Search".
    6. Click "multiple (x)" shown under one of the columns on the
    results screen.
    7. A new window will appear with an HTTP 400 error.
    

Local fix

  • Perform a search that will contain the additional results
    obtained when the drill down is working as expected.
    

Problem summary

  • Fixing this issue might affect all the exist saved searches and
    cause other issues. At this point, there is no plan to fix the
    issue.
    

Problem conclusion

  • Fixing this issue might affect all the exist saved searches and
    cause other issues. At this point, there is no plan to fix the
    issue.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IJ00800

  • Reported component name

    QRADAR SOFTWARE

  • Reported component ID

    5725QRDSW

  • Reported release

    728

  • Status

    CLOSED PRS

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2017-10-17

  • Closed date

    2018-09-27

  • Last modified date

    2018-09-27

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    QRADAR SOFTWARE

  • Fixed component ID

    5725QRDSW

Applicable component levels

[{"Business Unit":{"code":"BU048","label":"IBM Software"}, "Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"728","Edition":""}]

Document Information

Modified date:
27 September 2018