IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

How to identify duplicate Log Sources

  • 1.  How to identify duplicate Log Sources

    Posted Thu June 16, 2022 03:13 PM

    What is the best way identify duplicated Log Sources?



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: How to identify duplicate Log Sources

    Posted Fri June 24, 2022 07:37 PM

    Follow-up question.

    1. Do you mean that the Log Source Management app is displaying multiple log sources with the same Log Source Identifier? The Log Source Identifier should be a unique value for every log source.
    2. Or do you mean that events from a particular device are being created as unique log source types? For example, VMWare creating both Linux log sources and VMWare log sources. There is info on this scenario here: https://www.ibm.com/mysupport/s/question/0D50z00006PEHduCAH/qradar-duplicate-log-source?language=en_US

    If you could confirm it would help.



    #QRadar
    #Support
    #SupportMigration


Related Content