Troubleshooting
Problem
When you open an event in the Log Activity tab to view the event details, several custom fields display "null" as value, for example:
Symptom
- The Console is installed with QRadar version 7.4.3 or later.
- The fields are not present in the Custom Event Property configuration, so they cannot be disabled.
- The fields are not displayed in the DSM Editor, so it is not possible to assign a value.
- The issue persists after the web server (Tomcat) is restarted on the Console.
Cause
The reason of this behavior is because in QRadar V7.4.3, many fields were deprecated to standardize naming convention for custom properties. For a full list of deprecated fields, see Alias properties created for custom properties.
"During the upgrade to 7.4.3, and when you install content after the upgrade, alias properties are created for custom properties that don't conform to naming best practices."
The legacy custom event property fields were deprecated in the database, but not hidden in Log Activity or Network Activity tabs. As the alias properties still exist, they can lead to several custom properties that display a value of "null" in the user interface.
Resolving The Problem
An APAR exists for this issue as IJ34647. To subscribe to this issue, see IJ34647: UPGRADING TO QRADAR 743 RESULTS IN A LIST OF DEPRECATED CUSTOM EVENT PROPERTIES BEING DISPLAYED.
Administrators with deprecated custom property event names need to use the updated property names in their searches, rules, and reports. The use of the deprecated property names cannot be used. When you attempt to create a new custom event property that uses a deprecated field, the following error is displayed: "The name of custom properties definition is deprecated".
Figure 1: If you use the DSM Edit to create a property with a deprecated name, and error is displayed.
Figure 2: The Custom Event Property configuration interface also displays an error in the legacy user interface.
If you experience the error message, 'Property name 'EventID' is deprecated', you must assign a unique name to your custom event property.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"TS006247365","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
15 August 2022
UID
ibm16554708