IV89022: CUSTOM PROPERTIES SAVED TO ADVANCED SEARCHES (AQL) WITH INVALID SYNTAX ARE UNABLE TO BE DELETED

APAR status

• Closed as program error.

Error description

• Custom properties saved to Advanced Searches (AQL) with invalid
  syntax are unable to deleted.
  After selecting to delete the Custom Property an error message
  similar to the following is displayed:
  "Unable to parse the expression"
  
  The custom property is not deleted.
  

Local fix

• Remove the invalid searches and the deletion will work as
  expected.
  The invalid searches can be found in /var/log/qradar.log by
  searching for messages similar to:
  [tomcat] [pool-7-thread-1]
  com.q1labs.core.shared.datadeletion.CustomPropertyDeletion:
  [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]Unable to
  resolve query parameters, skipping dependency check for saved
  search with name: <Search_Name>
  

Problem summary

• Custom properties saved to Advanced Searches (AQL) with invalid
  syntax are unable to deleted.
  After selecting to delete the Custom Property an error message
  similar to the following is displayed:
  "Unable to parse the expression"
  
  The custom property is not deleted.
  

Problem conclusion

• This issue was resolved with QRadar/QRM/QVM/QRIF 7.3.0
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  QRADAR SOFTWARE

• Fixed component ID

  5725QRDSW

Applicable component levels

• R730 PSY

     UP