Hello Jonathan,
We have already performed Tomcat cache clearing and Vaccum & indexing on the console, but unfortunately, it did not resolve the issue. We have also raised a case with IBM support, and they have suggested us to check it on IBM forum.
------------------------------
Aby Francis
------------------------------
Original Message:
Sent: Thu July 18, 2024 11:21 PM
From: Jonathan Pechta
Subject: Duplicate entries on reference set even Ignore alphanumeric condition
This could potentially be a Tomcat (UI) issue where the service is experiencing issues and a clearing the Tomcat cache might resolve the problem. However, I'd recommend you open a case.
Typically, if the QRadar user interface shows duplicate values, you can check against the API or use the Reference Set Management app to double check. I've personally only ever seen duplicate values in the QRadar UI with ignore alphanumeric values on when there was a Tomcat issue incorrectly drawing the page. I would ask about this when we look in to the map of sets question you had in the other thread.
My guess in have the support rep clear the Tomcat cache. You can do this yourself, if you do not want to wait. Clearing the Tomcat cache does not negatively impact QRadar, but if this is QRadar on Cloud or you are not comfortable with this procedure, you can ask the support rep to clear the cache in QRadar for you.
Reference: https://www.ibm.com/support/pages/qradar-how-clear-tomcat-cache
------------------------------
Jonathan Pechta
IBM Security - Community of Practice Lead
jonathan.pechta1@ibm.com
Original Message:
Sent: Thu July 18, 2024 05:52 AM
From: Aby Francis
Subject: Duplicate entries on reference set even Ignore alphanumeric condition
Hi
We are experiencing an issue with the reference set. Despite setting the condition to ignore alphanumeric entries, we are still encountering duplicate entries.
Please help us to resolve this.
------------------------------
Aby Francis
------------------------------