• United States
IBM?
  • Site map
IBM?
  • Marketplace

  • Close
    Search
  • Sign in
    • Sign in
    • Register
  • IBM Navigation
IBM Developer Answers
  • Spaces
    • Blockchain
    • IBM Cloud platform
    • Internet of Things
    • Predictive Analytics
    • Watson
    • See all spaces
  • Tags
  • Users
  • Badges
  • FAQ
  • Help
Close

Name

Community

  • Learn
  • Develop
  • Connect

Discover IBM

  • ConnectMarketplace
  • Products
  • Services
  • Industries
  • Careers
  • Partners
  • Support
10.190.13.195

Refine your search by using the following advanced search options.

Criteria Usage
Questions with keyword1 or keyword2 keyword1 keyword2
Questions with a mandatory word, e.g. keyword2 keyword1 +keyword2
Questions excluding a word, e.g. keyword2 keyword1 -keyword2
Questions with keyword(s) and a specific tag keyword1 [tag1]
Questions with keyword(s) and either of two or more specific tags keyword1 [tag1] [tag2]
To search for all posts by a user or all posts with a specific tag, start typing and choose from the suggestion list. Do not use a plus or minus sign with a tag, e.g., +[tag1].
  • Ask a question

Error while saving in DSM Editor

50YWKCY4F3 gravatar image
Question by tarang777  (51) | Jun 29, 2018 at 08:30 AM qradarqradar_appdevcustomdsmdsm_editor

We have a custom log source type for our app, so from the dsm editor I'm trying to add MessageID as a custom property. Now, I have written a regex and extraction works fine as I see in Log Activity Preview. But when I try to save in the DSM editor I get the following error. Even no other property is getting saved for that particular Log Source Type. alt text

If change my Log Source Type(Some other custom built log source type dsmeditor) and add the same property in it and it saves successfully.

Tried the same thing in a fresh installed Qradar. Still, the same problem exists. Any way to debug this?

dsmerror.png (31.2 kB)

People who like this

  0
Comment
10 |3000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster

1 reply

  • Sort: 
50UVUCFRX0 gravatar image

Answer by MitchellMacLean (26) | Jun 29, 2018 at 09:12 AM

This is an issue that is likely going to require a support ticket. We would suggest that you open a case and collect logs for QRadar. We can try to assist via the forum, but this issue is likely going to be too complicated to diagnose here.

What to do
- Collect logs from the Console. - Log in to https://ibm.biz/qradarsupport

You can answer the following (make sure you also include this in your case)
1- What version of Qradar are you using?

2- What type of property is MessageID? (Text, Number, Alphanumeric, etc)

3- What regex and capture group are you using for that property in the DSM editor?

The information from items 1 to 3 will help us understand this issue a little better.

Comment

People who like this

  0   Share
10 |3000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster

Follow this question

143 people are following this question.

Answers

Answers & comments

Related questions

Invalid Extension Document : null 6 Answers

Hardcoded devicetypeid doesn't work with other application with same devicetypeid? 0 Answers

Incorrect event name and extractions as Event 0 2 Answers

Proofpoint TAP parsing assistance 2 Answers

How the source/destination ip are determined in log activity? 1 Answer

  • Contact
  • Privacy
  • IBM Developer Terms of use
  • Accessibility
  • Report Abuse
  • Cookie Preferences

Powered by AnswerHub

Authentication check. Please ignore.
  • Anonymous
  • Sign in
  • Create
  • Ask a question
  • Spaces
  • API Connect
  • Analytic Hybrid Cloud Core
  • Application Performance Management
  • Appsecdev
  • BPM
  • Blockchain
  • Business Transaction Intelligence
  • CAPI
  • CAPI SNAP
  • CICS
  • Cloud Analytics
  • Cloud Automation
  • Cloud Object Storage
  • Cloud marketplace
  • Collaboration
  • Content Services (ECM)
  • Continuous Testing
  • Courses
  • Customer Experience Analytics
  • DB2 LUW
  • DataPower
  • Decision Optimization
  • DevOps Services
  • Developers IBM MX
  • Digital Commerce
  • Digital Experience
  • Finance
  • Global Entrepreneur Program
  • Hadoop
  • Hybrid Cloud Core
  • IBM Cloud platform
  • IBM Design
  • IBM Forms Experience Builder
  • IBM Maximo Developer
  • IBM StoredIQ
  • IBM StoredIQ-Cartridges
  • IIDR
  • ITOA
  • InformationServer
  • Integration Bus
  • Internet of Things
  • Kenexa
  • Linux on Power
  • LinuxONE
  • MDM
  • Mainframe
  • Messaging
  • Node.js
  • ODM
  • Open
  • PowerAI
  • PowerVC
  • Predictive Analytics
  • Product Insights
  • PureData for Analytics
  • Push
  • QRadar App Development
  • Run Book Automation
  • Search Insights
  • Security Core
  • Storage
  • Storage Core
  • Streamsdev
  • Supply Chain Business Network
  • Supply Chain Insights
  • Swift
  • UBX Capture
  • Universal Behavior Exchange
  • UrbanCode
  • WASdev
  • WSRR
  • Watson
  • Watson Campaign Automation
  • Watson Content Hub
  • Watson Marketing Insights
  • dW Answers Help
  • dW Premium
  • developerWorks Sandbox
  • developerWorks Team
  • Watson Health
  • More
  • Tags
  • Questions
  • Users
  • Badges