Use Filter Modes

Items and Item Types in filters can be included (Filter In) or excluded (Filter Out).

1. From the feature you want to add a filter to, select an option in the Add New Field Filter.
2. Click Edit Values.
3. Select one of the following:
   • To include all matching values, select Filter In (Is).
     When Filter In (Is) is selected, the option to Filter in Null Values appears. If you want to include events when the field option is blank, select the Filter in Null Values? check box.
   • To exclude all matching values, select Filter Out (Is Not).
     When Filter Out is selected, the option to Filter out Null Values appears. If you want to exclude events when the field option is blank, select the Filter out Null values? check box.
4. Add an Item or List, and then click OK.

You can also edit the Filter Mode from the Add New Field Filter dialog box by selecting a different option in the Filter Mode column in the grid. 

You can also add a filter on the selected fields by clicking the Add List button in the common Field Filter Values popup window. This popup window is displayed wherever you can apply filters like Investigation, Tail, Alarm Rules, AI Engine, etc.