Copying and removing log sources

You can copy a log source to one or more groups to suit your organizational needs. When you no longer need a log source in a particular group, you can remove it. Removing a log source from a group does not delete the log source from IBM® QRadar®.

1. Click the Admin tab.
2. In the Data Sources section, click Log Source Groups.
3. From the navigation tree, select the relevant log source group.
4. To copy the log source, complete the following steps:
   1. In the Group Content window, select the relevant log source and click Copy.
   2. In the Choose Group window, select the group that you want to copy the log source to, and click Assign Groups.
5. To remove the log source, complete the following steps:
   1. In the Group Content window, select the relevant log source and click Remove.
   2. In the Confirmation window, click OK.