Question & Answer
Why are my custom properties not showing up in rules, reports and searches?
Optimize parsing for rules, reports, and searches was not selected when the custom property was created.
To resolve this issue:
- Go to the QRadar UI.
- In the Admin tab under Data Sources open Custom Event Properties.
- Select the Custom Property that you are having issues with and edit it.
- In Custom Event Properties from the Property Definition screen ensure that check box for Optimize parsing for rules, reports, and searches is selected.
- Click Save. There is no need to Deploy Changes.
Where do you find more information?
Was this topic helpful?
16 June 2018