IBM Support

QRadar: The API returns an error "The search does not exist" when trying to pull information from search ID.

Troubleshooting


Problem

When trying to pull information from a search ID by using the API, an error is displayed:
{
  "http_response": {
    "code": 404,
    "message": "We could not find the resource you requested."
  },
  "code": 1002,
  "description": "The search does not exist.",
  "details": {},
  "message": "Query <SEARCH_ID> does not exist"
}

Cause

This issue appears if the search is deleted and throws a 404-error code while performing an API call.

Diagnosing The Problem

  1. SSH into the QRadar Console.
  2. Run the following command: 
    grep "<SEARCH_ID>" /var/log/audit/audit.log
    Note: In this command, replace <SEARCH_ID> with the actual value of the search ID.
  3. If it prints an error similar to the following, proceed to the next step: 
    [Action] [Search] [SearchResultsDeleted] Search results deleted, details="Id:<SEARCH_ID>, Reason:data is expired, exp.date: 23-02-02,16:25:27"
Result
If it is giving output like search results deleted, then you can follow the steps in Resolving the Problem. If it is not, you are not experiencing this error.

Resolving The Problem

  1. Log in to your QRadar Console UI.
  2. Click the Admin tab.
  3. Click the System Settings.
  4. In Ariel Database Settings, modify the Search Results Retention Period setting according to the requirement.
Result
To learn more about the Search Results Retention Period, see QRadar: Why do some search results have Never in the Expires On column. If you still have any issues, contact support.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwthAAA","label":"Offenses"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
10 March 2023

UID

ibm16956814

Page Feedback