Question: qradar how to drop events?
Answer: Events and flows are dropped when the IBM® QRadar® processing pipeline can't handle the volume of incoming events and flows, or when the number of events and flows exceeds the license limits for your deployment. You can look at the QRadar log file messages when these situations occur.