IBM Support

QRadar: Report collected data from an unexpected time period

Troubleshooting


Problem

The daily report did not collect the data for the expected time range.

Symptom

The daily report didn’t collect the correct date and time.
For example, A daily report run on the early morning of 9 October is intended to collect the data from midnight 8 October to midnight 9 October, but instead collects the data from 6 AM 7 October to 6 AM 8 October.

Cause

Reports use the time zone configured in the "Daily Scheduling" section to query event or flow data.
If the "Daily Scheduling" time zone is significantly different from the system time zone, data returned in a daily report might not cover the intended time period.

Resolving The Problem

Check the report configuration in the report wizard

  1. Log in to the QRadar GUI.
  2. Click the Reports tab.
  3. Open the selected report in Report Wizard.
  4. Click Next until you reach the Specify Report Contents page
    image-20231212162813-1
  5. Click Define to view the chart configuration.
  6. Review the time zone configuration to ensure that it is set to the appropriate time zone. In most deployments, this setting is the same as the system time zone for the Console.
    image-20231212163645-2
  7. If the time zone setting in the report chart is incorrect, change the value to the intended time zone.
    Result
    Generated reports for the template now reflect the correct time period.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtmAAA","label":"Reports"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
12 December 2023

UID

ibm17095778

Page Feedback