IBM Support

QRadar: Unique counts enabled in searches and reports for large data sets (APAR IJ11170)

Troubleshooting


Problem

Dashboards and Reports created with searches that use unique counts can display results that are different than what is displayed for the same search run in Log Source activity. Dashboard results over longer periods display values lower than values over a more recent time period. 

Symptom

To reproduce this issue.
  1. Click Log Activity tab.
  2. Click New Search.
  3. Enter a Specific Interval with Start and End Time.
  4. Scroll to Column Definitions.
  5. Create a search that has a Group By: filter.
    image-20200225102953-2
  6. Click Search.
  7. Click the Gear on the completed search and select a filter with a Unique Count enabled.
    image-20200225120510-3
  8. Click Save Criteria.
  9. Add a Search Name.
  10. Add it to an Assigned Search.
  11. Click Share With Everyone 
  12. Select the Include in my Dashboard checkbox.
  13. Click Dashboard tab.
  14. Click Add Item > Event Searches > Your saved search Dashboard.
    image-20200225123435-1
  15. Click View in Log Activity.
Results
The Graph is different than the one on the Dashboard

image-20200225123633-2

Resolving The Problem

The number of unique IPs counted in the dashboard drop with time. The accumulator is not counting them because they are not unique. In Log Activity, the number is still accumulating. The result is a discrepancy between the dashboard graph and log activity graphs.
 A workaround to resolve this issue is to create a dashboard in the Pulse App. 
  1. Click Log Activity.
  2. Click Edit Search.
  3. Click your saved search used with your dashboard.
  4. Click Show AQL
  5. Click Copy to Clipboard.
  6. Click Pulse tab.
  7. Click Manage Dashboard > New Dashboard Item.
  8. Add Dashboard Item Name and Description.
  9. Click Data Source AQL.
  10. Paste the AQL Statement in the box.
  11. Click Run Query.
  12. Add a View Name.
  13. From Chart Type Select Bar Chart from the drop-down.
  14. Click Save
Results
The dashboard created in the Pulse App displays accurate information. If you need an enhancement to the QRadar Dashboard to allow more accurate tracking of unique counts, refer to the RFE community to submit a request.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Dashboard","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
11 January 2021

UID

ibm13380097

Page Feedback