Closed as fixed if next.
On the Admin tab, the Custom Event Properties and Custom Flow Properties might display special characters in an unexpected format. For example, the Test Field might display spaces as and quotes (") as ". This issue might prevent the default regular expression in the RegEx field to not highlight matched text as expected.
You can use the following procedure to ensure the Test Field displays special characters correctly: 1. Log in to your QRadar Console. 2. Click the Log Activity tab. 3. Click Extract Property. The Custom Event Properties window displays the raw event payload in the Test Field. Any special characters in the raw event payload are displayed in their raw format, for example a quote character (") is ". 4. Select any of the text inside Test Field. 5. Click Test. Special characters are correctly displayed in the Test Field.
This issue has been resolved in QRadar SIEM 7.2.4.
Reported component name
Reported component ID
Last modified date
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Applicable component levels