Filter Modes

Items and item types in filters can be set to include or exclude. The following examples explain those settings.

  • Filter In (Is)
    User (Origin or Impacted) IS ‘pete’
    Result: Either Origin nor Impacted has the value ‘pete’. At least one of the fields has a value of ‘pete’.

  • Filter In (Is) Blank with Filter in Null Values?
    User (Origin or Impacted) IS NULL
    Result: Either Origin or Impacted is NULL. At least one of the fields must be null.

  • Filter Out (Is Not)
    User (Origin or Impacted) IS NOT ‘pete’
    Result: Neither Origin nor Impacted has the value ‘pete’. Both fields have a value other than ‘pete’

  • Filter Out (Is Not) Blank with Filter out Null Values?
    User (Origin or Impacted) IS NOT NULL
    Result: Neither Origin nor Impacted is NULL. Both fields must have a value.

Quantitative Filters

Quantitative filters are available from these LogRhythm tools and utilities:

  • Alarm Rules
  • GLPR wizard
  • Investigator
  • Log Distribution Services (LDS )
  • Personal Dashboard filters
  • Reports
  • SecondLook
  • Tail

Quantitative fields include:

  • Amount
  • Bytes Sent and Bytes Rcvd
  • Duration
  • Packets Sent and Packets Rcvd
  • Quantity
  • Rate
  • Size

The operators for quantitative filters are described in the following table.

OperatorDescription
=Equal to
!=Not equal to
>Greater than
>=Greater than or equal to
<Less than
<=Less than or equal to
<>Less than or greater than - (outside range)
<=>=Less or equal to OR greater or equal to - (outside range)
><Greater than AND less than - (between range)
>=<=Greater or equal to AND less than or equal to - (between range)

Wildcards in Search Strings

LogRhythm can use wildcards and pattern matching in search string filters to increase flexibility and efficiency. For example:

  • Use wildcards to search for a particular sender or recipient email address in the Platform Manager, Data Processor, or LogMart by specifying only some of the characters in the address.
  • Filter to find any matches for senders at a given domain name.
  • Filter to find a specific host name.