IBM Support

QRadar: Error When Attempting to Export Events: 'Waiting for export to commence'

Troubleshooting


Problem

When a user tries to export the results of a search, they might receive a message: "Waiting for export to commence”.

Symptom

When a user attempts to export data from the Log Activity or Network Activity tabs, nothing is exported. No errors are reported on screen or in the logs, and no change occur in the user interface until user cancels the request.

Cause

If the user is attempting to export the search results and the request is not succeeding or failing, Maximum Simultaneous Exports parameter might be set to 0. If it is set to 1 and there is another user processing an export, this situation also happens.

Diagnosing The Problem

When a user tries to export data, the following message is presented, and no data is exported.
export waiting

Resolving The Problem

To enable multiple exports in QRadar®, the administrator must ensure that the Maximum Simultaneous Exports value is set to the maximum amount of allowed user to export data at the same time.
Procedure
  1. Log in to the QRadar Console as an administrator.
  2. Click the Admin tab.
    admin
  3. Click the System Settings icon.
    ss
  4. Select Data Export Settings and verify the value of the Maximum Simultaneous Exports.
    ss - des1
  5. Change the value of the Maximum Simultaneous Exports to the amount that you need for your users and click Save.
    changed
  6. Back in the Admin tab, click Deploy Changes.
    deploy
  7. Return to the Log Activity tab or Network Activity tab, and attempt to do the export of data again.
Result
The export displays a dialog to the user when it begins or begins the download immediately.
    
If you continue experiencing issues with exports, the setting for Maximum Simultaneous Exports or errors in the user interface, contact QRadar Support.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
30 August 2022

UID

ibm16616103