IBM Support

QRadar: Content Extension or Application Installation Fails on CEP Conflict

Troubleshooting


Problem

When an administrator attempts to install a content package or application with Custom Extraction Properties (CEP) through Extensions Management, the installation preview sometimes shows a single property and a status of FAILED. If the administrator chooses to continue with the installation, it fails to proceed with the message "An error occurred. See console logs for details." This behavior normally indicates a CEP that's being imported is in conflict with one that's already on the system. 

Symptom

During a content pack or application installation, there is a screen to preview the changes it is installing. If there is a conflicting CEP, it shows a FAILED message:
Install Preview Example
This Originating_User is the name of the CEP in conflict, but this name might differ on your system. Throughout this technote, we are using the Originating_User property as an example.

Document Location

Worldwide

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)","Line of Business":{"code":"LOB77","label":"Automation Platform"}}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
08 October 2020

UID

ibm16205797