Hey community,

I experienced in several QRadar Deploments the same "new" behavior after updating to 7.6.0.2 (This topic I've seen also with 7.6.0 and 7.6.0.1).
Here the steps which worked in previous 7.5.0x as expected, now changed with 7.6.0.x:

1. Open Log Activity
2. Start creating a new search using View -> for example a time value of "1 hour". Display is showing "Default (normalized)"
3. Switch Display to Display: Username -> The screen shows the expected results grouped by Username
4. Now switch View: to a different time value, for example 6 hours, because you want to extend the results for your investigations... -> Screen immediately empty, no results!
   
   

That's strange and not expected! Step 4 has worked with 7.5.0x and the expected result has been adjusted to 6 hours and the result has been updated directly for this time range! Now many analysts I'm aware are irritated and reflects this new behavior, showing no results, as not user-friendly..

I identified a workaround for now, but this is for analysts in daily business not really handy...

• Switch now the display option back to "default normalized" -> results are updated for the selected 6 hours time range and shows the results!
• Now you can switch again the display option again to username or any other option and the results will be updated as expected!
• If you now adjust again the time range in VIEW to any other value... guess... correct, the result immediately empty again! This is not funny!

Summary:
If you aware about this workaround adjusting every time the "display option fall back" to default normalized and than selecting the desired option, after changing the VIEW value, you can deal with this "new behavior". But from my point of experience, this needs to be fixed immediately! :)

@IBM Support are you aware about this "usabillity" change dealing with log activity searches?

Regards,

Ralph

------------------------------
Ralph Belfiore
Managing Consultant | SIEM | Detection Engineering | Incident Reality
connecT SYSTEMHAUS AG
Siegen
------------------------------

Hi,

This may be a browser caching issue in your environment or perhaps a Tomcat caching issue. I cannot reproduce this on any of my systems with the mentioned versions, it works as expected. 

Steps to try:
1. Clear the browser cache. Try with a different browser.
2. Open a Support ticket, work with Support.
3. In some case, Tomcat cache clearing helps - https://www.ibm.com/support/pages/qradar-how-clear-tomcat-cache?view=full

------------------------------
Perf1
------------------------------

Hi,

i cleared browser cache and tried with chrome and firefox as well. Also a private window... It's always the same...

Regards,

Ralph

------------------------------
Ralph Belfiore
Managing Consultant | SIEM | Detection Engineering | Incident Reality
connecT SYSTEMHAUS AG
Siegen
------------------------------

Original Message:
Sent: 08/05/26 09:51 AM
From: Perf1
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

This may be a browser caching issue in your environment or perhaps a Tomcat caching issue. I cannot reproduce this on any of my systems with the mentioned versions, it works as expected. 

Steps to try:
1. Clear the browser cache. Try with a different browser.
2. Open a Support ticket, work with Support.
3. In some case, Tomcat cache clearing helps - https://www.ibm.com/support/pages/qradar-how-clear-tomcat-cache?view=full

------------------------------
Perf1
------------------------------

Great, continue to the next step.

------------------------------
Perf1
------------------------------

Original Message:
Sent: 08/05/26 09:59 AM
From: Ralph Belfiore
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

i cleared browser cache and tried with chrome and firefox as well. Also a private window... It's always the same...

Regards,

Ralph

------------------------------
Ralph Belfiore
Managing Consultant | SIEM | Detection Engineering | Incident Reality
connecT SYSTEMHAUS AG
Siegen
------------------------------


Original Message:
Sent: 08/05/26 09:51 AM
From: Perf1
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

This may be a browser caching issue in your environment or perhaps a Tomcat caching issue. I cannot reproduce this on any of my systems with the mentioned versions, it works as expected. 

Steps to try:
1. Clear the browser cache. Try with a different browser.
2. Open a Support ticket, work with Support.
3. In some case, Tomcat cache clearing helps - https://www.ibm.com/support/pages/qradar-how-clear-tomcat-cache?view=full

------------------------------
Perf1
------------------------------

Hi,

I can confirm the same weird behavior. Really annoying 

------------------------------
Dmitry Berezovik
------------------------------

Original Message:
Sent: 08/05/26 09:59 AM
From: Ralph Belfiore
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

i cleared browser cache and tried with chrome and firefox as well. Also a private window... It's always the same...

Regards,

Ralph

------------------------------
Ralph Belfiore
Managing Consultant | SIEM | Detection Engineering | Incident Reality
connecT SYSTEMHAUS AG
Siegen
------------------------------


Original Message:
Sent: 08/05/26 09:51 AM
From: Perf1
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

This may be a browser caching issue in your environment or perhaps a Tomcat caching issue. I cannot reproduce this on any of my systems with the mentioned versions, it works as expected. 

Steps to try:
1. Clear the browser cache. Try with a different browser.
2. Open a Support ticket, work with Support.
3. In some case, Tomcat cache clearing helps - https://www.ibm.com/support/pages/qradar-how-clear-tomcat-cache?view=full

------------------------------
Perf1
------------------------------

Hi Dimitry

Here is the Known Issue for this with a workaround

https://www.ibm.com/mysupport/s/defect/aCIgJ000000IEkT/dt498086?language=en_US

Thanks

------------------------------
John Dawson
Qradar Support Architect
IBM
------------------------------

Original Message:
Sent: 08/06/26 03:27 AM
From: Dmitry Berezovik
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

I can confirm the same weird behavior. Really annoying 

------------------------------
Dmitry Berezovik
------------------------------


Original Message:
Sent: 08/05/26 09:59 AM
From: Ralph Belfiore
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

i cleared browser cache and tried with chrome and firefox as well. Also a private window... It's always the same...

Regards,

Ralph

------------------------------
Ralph Belfiore
Managing Consultant | SIEM | Detection Engineering | Incident Reality
connecT SYSTEMHAUS AG
Siegen
------------------------------



Original Message:
Sent: 08/05/26 09:51 AM
From: Perf1
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

This may be a browser caching issue in your environment or perhaps a Tomcat caching issue. I cannot reproduce this on any of my systems with the mentioned versions, it works as expected. 

Steps to try:
1. Clear the browser cache. Try with a different browser.
2. Open a Support ticket, work with Support.
3. In some case, Tomcat cache clearing helps - https://www.ibm.com/support/pages/qradar-how-clear-tomcat-cache?view=full

------------------------------
Perf1
------------------------------

Hi Ralph. 

I do not see this happening in my lab; changing to several View and Display options - I get the resulting records shown. 

(7.6.0.0 CR Build 20260513000000,  patched to 7.6.0 FP1 Build 20260710212409, with Fix Pack 2 applied)

That said, I had experienced in some old versions that changing the period under View does not show properly results, but clicking the Update button (by the end time) would do the trick. Does that  or making a small change to Start Time / End Time and than hitting Update change anything? 

------------------------------
Dusan VIDOVIC
------------------------------

Original Message:
Sent: 08/05/26 09:59 AM
From: Ralph Belfiore
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

i cleared browser cache and tried with chrome and firefox as well. Also a private window... It's always the same...

Regards,

Ralph

------------------------------
Ralph Belfiore
Managing Consultant | SIEM | Detection Engineering | Incident Reality
connecT SYSTEMHAUS AG
Siegen
------------------------------


Original Message:
Sent: 08/05/26 09:51 AM
From: Perf1
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

Hi,

This may be a browser caching issue in your environment or perhaps a Tomcat caching issue. I cannot reproduce this on any of my systems with the mentioned versions, it works as expected. 

Steps to try:
1. Clear the browser cache. Try with a different browser.
2. Open a Support ticket, work with Support.
3. In some case, Tomcat cache clearing helps - https://www.ibm.com/support/pages/qradar-how-clear-tomcat-cache?view=full

------------------------------
Perf1
------------------------------

Hello,

I was able to reproduce this on 7.6.0.1 using Firefox and Edge on my test-system. It seems not to be a browser cache issue. 
I think it is a defect. I cannot search Support Cases right now - therefore don't know if a case has already been opened.
I'll discuss this with my customers (who are evaluating 7.6 right now) - perhaps we will open a case for this.
Thanks for pointing this out to the community.

Update:  I was not able to reproduce this on a customer site on 7.6.0.2. So the error is likely to occur intermittently. I'm working on figuring out what's causing this.

Regards, Peter Wenzl, IBM TEL

------------------------------
Peter Wenzl
------------------------------

I can confirm this is indeed happening on 7.6.2.  Glad I heard this before I upgraded production.  
Thanks Ralph!

------------------------------
Frank Eargle
Senior Information Security Architect
GlassHouse Systems
Columbia SC
------------------------------

Hi Frank

Here is the Known Issue for this with a workaround

https://www.ibm.com/mysupport/s/defect/aCIgJ000000IEkT/dt498086?language=en_US

Thanks

------------------------------
John Dawson
Qradar Support Architect
IBM
------------------------------

Original Message:
Sent: 08/06/26 08:11 AM
From: Frank Eargle
Subject: QRadar 7.6.0.2 | Creating new searches in Log Activity has become less user-friendly and usability almost unusable compared to previous 7.5.0UP15x

I can confirm this is indeed happening on 7.6.2.  Glad I heard this before I upgraded production.  
Thanks Ralph!

------------------------------
Frank Eargle
Senior Information Security Architect
GlassHouse Systems
Columbia SC
------------------------------

We have been looking into this and have come up with a workaround.

When you run a last x minute search select the option just below the Display option to Show Charts

This should then work as expected.

We are continuing to investigate what caused the change in behaviour in 7.6

Thanks

------------------------------
John Dawson
Qradar Support Architect
IBM
------------------------------

Here is the Known Issue for this

https://www.ibm.com/mysupport/s/defect/aCIgJ000000IEkT/dt498086?language=en_US

Thanks

------------------------------
John Dawson
Qradar Support Architect
IBM
------------------------------