Question & Answer
Question
Why are my custom properties not showing up in rules, reports and searches?
Cause
Optimize parsing for rules, reports, and searches was not selected when the custom property was created.
Answer
To resolve this issue:
- Go to the QRadar UI.
- In the Admin tab under Data Sources open Custom Event Properties.
- Select the Custom Property that you are having issues with and edit it.
- In Custom Event Properties from the Property Definition screen ensure that check box for Optimize parsing for rules, reports, and searches is selected.
Example
- Click Save. There is no need to Deploy Changes.
Where do you find more information?
[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Integrations - IBM","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"Enterprise","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Historical Number
1585
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21622236