Create or edit Filter elements

All the permanent Filter elements are stored and can be edited from one view.

Tip: An easy way to create a permanent Filter element is to create a local filter, then save it as a Filter element.

For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Select Configuration, then browse to Monitoring.
  2. Expand the Other Elements branch.
  3. To create a new filter:
    1. Right-click Filters.
    2. Select New > Filter.
  4. To edit an existing filter:
    1. Browse to Filters > All Filters.
    2. Right-click the filter, then select Properties.
  5. Edit the filter properties, then define the filtering criteria.
  6. Click OK.

Filter Properties dialog box (permanent Filter element)

Use this dialog box to create a permanent Filter element that can be used anywhere in the Management Client.

Option Definition
General tab
Name The name of the element.
Category

(Optional)

 Includes the element in predefined categories. Click Select to select a category.
Comment

(Optional)

 A comment for your own reference.
Undefined Value Policy

Defines how data entries are matched when a field is included in the filter, but is not present in the entry (for example, if a filter defines a range of destination ports, but the operation encounters a log entry of traffic over a protocol that does not use ports, such as ICMP).

  • False by comparison: The AND operations are false. As a result, also the OR operation is false. The event does not match the Filter.
  • False by filter: The AND operations are undefined (neither true nor false). As a result, also the OR operation is undefined. The setting interprets the undefined result as false. The event does not match the Filter.
  • True by filter: The AND operations are undefined (neither true nor false). As a result, also the OR operation is undefined. The setting interprets the undefined result as true. The event matches the Filter.
  • Undefined: The AND operations are undefined (neither true nor false). As a result, the OR operation is also undefined. The Undefined setting passes the undefined value to the component that uses the log data, which interprets the undefined result as false. The event does not match the Filter.
New Select a filter to use. To browse for a filter, select Select.
Undo operation Undoes the last change made.
Redo operation Redoes the last change that was undone.
Remove (Delete) Removes the selected part of the expression.
require all of (and) Adds an AND operand.
require any of (or) Adds an OR operand.
NOT Adds a NOT operand.
Option Definition
Tags tab
Tags table Shows the details of the tags associated with the element.
Name Shows the name of the tag.
Comment An optional comment for your own reference.
Type Shows the type of the tag.
Add Tags Adds a tag to the table.

Save Filter dialog box

Use this dialog box to save a filter for use with command-line tools.

Option Definition
Filter Shows the filter name.
Destination File Select where to save the destination file:
  • Log Server — The file is saved on the Log Server.
  • Local Workstation — The file is saved on your local workstation.
Browse

(Only if Local Workstation is selected)

Opens the Export Data search window.