IBM Support

QRadar: How to find and cancel searches that are running in the background

How To


Summary

When the searches running in the background are expensive, they can cause performance issue. This article explains how to find them and cancel them by using the graphical interface.

Steps

A running search could be sent to the background due to multiple reason like clicking another tab or option outside the Log Activity, clicking again the Log Activity tab or even when the page is refreshed.
Use these steps to find and cancel running searches:
  1. Log in to QRadar.
  2. Click Log Activity tab.
    image-20221031130749-1
  3. Click Search option.
    image-20221031130844-2
  4. From the Search menu, select Managed Search Results.
    image-20221031131050-3

    Result
    The running searches and their characteristics are displayed. Here the admin can highlight the searches they want to stop and then click Cancel to stop them.image-20221028140119-1

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwtEAAQ","label":"Log Activity"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
31 October 2022

UID

ibm16831793