Create local filters

You can create local filters in various views in the Management Client.

For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Open a view or element for editing.
  2. Depending on the view or dialog box, create the local filter in one of the following ways:
    View/Dialog box Configuration steps
    Monitoring views

    (Logs, Connections, block list, VPN SAs, Users, Routing, or SSL VPNs)

    		On the Filter tab in the Query pane, click New, then select New > Filter to create a filter from a list of available fields, or select New > Filter:<field name> to create a filter based on a preselected field.
    Tip: You can also drag and drop log data rows onto the Filter tab
    Reports view Report Design
    1. Select the name of the Report Design.
    2. In the Report Properties pane, click the Select Element button next to the Filter field.
    Report Section
    1. Select the Report Section.
    2. In the Section Properties pane, click the Select Element button next to the Filter field.
    Report Item Double-click the Report Item.
    Administrator Properties dialog box
    1. Switch to the Permissions tab.
    2. Click Select next to Filter. The Local Filter Properties dialog box opens.
    Log Server Properties or Management Server Properties dialog box
    1. For the Log Server, switch to the Log Forwarding tab, then click Add to add a Log Forwarding rule.
    2. For the Management Server, switch to the Audit Forwarding tab, then click Add to add an Audit Forwarding rule.
    3. Double-click the Filter cell. The Local Filter Properties dialog box opens.
    Correlation Situation Properties dialog box
    1. Switch to the Context tab.
    2. Click Select next to the Context field, then select Compress, Group, Match, or Sequence.
    3. For Compress or Match, click Select next to the Compress filter field. The Local Filter Properties dialog box opens.
    4. For Group or Sequence, double-click the Event Match cell. The Local Filter Properties dialog box opens.
  3. (If not in a Monitoring view) Select Add > New > Filter to create a filter from a list of available fields or Add > New > Filter:<field name> to create a filter based on a preselected field.
  4. Edit the filter in the Filter Properties dialog box.
    • If you are creating a filter from a list of available fields, enter an optional name in the Name field. Select the setting for Undefined Value Policy, then define the filtering criteria.
    • If you are creating a filter based on a preselected field, edit the filter properties. The available options depend on the field type.
  5. Click Apply.

    The filter is added to the Local Filter Properties dialog box.

    In a Monitoring view, the filter is added to the Filter tab in the Query pane.

  6. (Optional) Edit the local filter:
    • To negate a filter row, click the corresponding checkbox. This option filters out entries that match the filter.
    • If a row contains more than one item, click the operator cell to toggle between the and and or operators.


    1
    Negate a filter.
    2
    Toggle between operators.
  7. (Optional) To save a local filter as a permanent Filter element, click Save. In a Monitoring view, click Save.
    You can use Filter elements in any view.
  8. Click OK. In a Monitoring view, click Apply.

Local Filter Properties dialog box

Use this dialog box to change the properties of a local filter.

Option Definition
Name Specifies the name of the filter.
Filters table
  • To negate a filter row, click the corresponding checkbox. This filters out entries that match the filter.
  • If a row contains more than one item, click the and/or cell to toggle between the AND and OR operators.
  • Right-click a filter row to open a list of options to modify, add, and delete filters.
Add Select from the menu to add.
  • Select — Opens the Select Filter dialog box.
  • New — Select the type of filter and the Filter Properties dialog box opens.
  • Row — Adds an empty row to the Filters table.
Remove Removes the selected filter.
Save Opens the Filter Properties dialog box.

Filter Properties dialog box (local filter)

Use this dialog box to create a local filter.

Option Definition
Field Shows the selected field.
Select Opens the Select Element dialog box.
Comparison The available Comparison selection depends on the selected field and whether the field already contains one or more values.
Add Adds the entered value to the value list.
Apply Retains your changes and closes the window.