how to export DSM with all custom mappings
We've created an custom DSM with the DSM editor, we have 2 seperate instances of an qradar console. We created the dsm on one machine and want to use it on another. How can i export the custom DSM with ALL info including QID mappings. We have created eventids and mapped them to existing QID enties but the imported DSM doesnt show any mappings at all.
Hi MartijnG,
Just exporting the custom log source type won't include the QIDs and mapping records automatically. You'll need to do your export using the -c package option, which points to a "manifest" file of sorts:
/opt/qradar/bin/contentManagement.pl -a export -c package -f packageContents.txt
In the file, you need one line per content type you want to export. Each line is a comma-separated list of values, where the first value is the content type (which you can get from the '/opt/qradar/bin/contentManagement.pl -h export' output) and each additional value is the identifier for an item of that type. So you need a line for your log source type, then another for your QIDs. The mappings attached to the QIDs will be included automatically.
have a look at these doc links for more information: