IBM Support

QRadar: Custom Event Property not appearing in event properties rule list

Question & Answer


Question

Why are my custom properties not showing up in rules, reports and searches?

Cause

Optimize parsing for rules, reports, and searches was not selected when the custom property was created.

Answer

To resolve this issue:

    1. Go to the QRadar UI.
    2. In the Admin tab under Data Sources open Custom Event Properties.
    3. Select the Custom Property that you are having issues with and edit it.
    4. In Custom Event Properties from the Property Definition screen ensure that check box for Optimize parsing for rules, reports, and searches is selected.

      Example

    5. Click Save. There is no need to Deploy Changes.


Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Integrations - IBM","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"Enterprise","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Historical Number

1585

Document Information

Modified date:
16 June 2018

UID

swg21622236