IBM Support

QRadar: Custom Event Property not appearing in event properties rule list

Question & Answer


Why are my custom properties not showing up in rules, reports and searches?


Optimize parsing for rules, reports, and searches was not selected when the custom property was created.


To resolve this issue:

    1. Go to the QRadar UI.
    2. In the Admin tab under Data Sources open Custom Event Properties.
    3. Select the Custom Property that you are having issues with and edit it.
    4. In Custom Event Properties from the Property Definition screen ensure that check box for Optimize parsing for rules, reports, and searches is selected.


    5. Click Save. There is no need to Deploy Changes.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Integrations - IBM","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"Enterprise","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Historical Number


Document Information

Modified date:
16 June 2018