IBM Support

QRadar: Moving a Data Node from one host to another in your deployment

How To


Summary

This article outlines the steps to move a Data Node from one processor to another. For example, a user might need to move a Data Node from an existing appliance to another applicable host. Several appliances include the event processor component (ecs-ep) required to host a Data Node, such as a Console (31xx), Event Processor (16xx), or Combination Event/Flow Processor (18xx).

Objective

To successfully move a Data Node from one host to another in the user interface.

Environment

All supported QRadar versions.

Steps

To move a Data Node from one host to another, you must have admin permissions in QRadar.

Procedure
  1. Click the Admin tab.
  2. Click the System and License Management icon.
  3. In the Display drop-down, select Systems.
  4. Select the Data Node you want to move to another processor.
  5. Click Deployment Actions > Edit Host Connection.
    image-20221212125035-1
  6. Select a new host for the Data Node appliance.
    image-20221212130849-1
    Note: An asterix character (*) denotes the appliance that currently hosts the Data Node.
  7. Click Save.
  8. Click Deploy Changes to update the Data Node connection in the deployment.

    Results
    After the Data Node is moved to the new appliance, the Data Node rebalances automatically. For more information, see Data rebalancing after a data node is added. If you experience errors in the user interface when you attempt to move a Data Node, contact QRadar Support.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
07 August 2023

UID

ibm16847299