IBM Support

QRadar: Not able to delete log source groups because "Remove" and "Copy" buttons are disabled.



The "Remove" and "Copy" buttons are disabled and the user is not able to delete the Log Source group.



The Remove and Copy buttons are disabled by design.

Diagnosing The Problem

Resolving The Problem

You cannot delete items in the tree. They have to be deleted out of the list grid by using the procedure.

  1. Log in to the QRadar® UI as an admin user.
  2. Click the Admin tab.
  3. Click Log Source Groups.
  4. Click "New Group" enter a name.
  5. Click "All Log Source Groups" on the tree on the left.
  6. Click your new group in the list on the right.
  7. Verify that the Remove button is enabled.

After this, the Log source group can be deleted. 
Note: The Copy button is never enabled for groups. It is for copying an item from one group to another.

Document Location


[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
15 July 2021