Hello Jonathan,
IBM support has already provided the below script to delete the expired reference set. However, this is a temporary solution and it is not feasible to perform this regularly. We kindly request you to provide a permanent fix for this issue.
for i in {1..10}; do echo "$i runs"; ./ReferenceDataV3.sh; sleep 2; done
------------------------------
Aby Francis
------------------------------
Original Message:
Sent: Thu July 18, 2024 02:02 PM
From: Jonathan Pechta
Subject: Expired Entry from the reference data is not getting deleted
There is a known issue that allows users to create reference maps without related keys. This leads to issues where the API or the system attempts to delete the data, but cannot as the reference key is null. I don't think that is your issue, but one good check to do is to confirm if the "Time to Live = 0s" in the user interface. Data at 0 seconds should be removed from the Reference data UI when you refresh or open and close the UI screen. If you see data that is at 0 seconds in the UI, then something is going on and we might need to investigate.
I would install the Reference Data Management app and see if there is a key in the UI. If you get an error, such as "Map of sets <Name of your set> does not contain key [key]". then this is the root cause.
There also might be an issue where the reference map of sets was associated to a domain which has been removed or no longer accessible for some reason that can cause what you are seeing as well.
I think you likely need to open a support case on both of the posts you created so we can investigate. As it is very hard to troubleshoot without error messages or version information.
As a temporary workaround, assuming that this is not QRadar on Cloud and an on-premise QRadar, you could use the CLI and try to manually delete a value. For example, /opt/qradar/bin/ReferenceDataUtil.sh delete "ReferenceSetName" "value"
If you have a value to delete, you could try this or see if it generates an error. Optionally, as mentioned open a support case so we can examine this issue in more detail. I would try to delete a value, then collect logs from the Console so we can see what errors are displayed.
------------------------------
Jonathan Pechta
IBM Security - Community of Practice Lead
jonathan.pechta1@ibm.com
Original Message:
Sent: Thu July 18, 2024 05:41 AM
From: Aby Francis
Subject: Expired Entry from the reference data is not getting deleted
Hi
We are facing issue with the reference map of set.
The expired elements entry from the reference data is not getting deleted.
Please help us
------------------------------
Aby Francis
------------------------------