Use the Filter Editor
Filter Modes
Items and item types in filters can be set to include or exclude. The following examples explain those settings.
- Filter In (Is)
User (Origin or Impacted) IS ‘pete’
Result: Either Origin nor Impacted has the value ‘pete’. At least one of the fields has a value of ‘pete’. Filter In (Is) Blank with Filter in Null Values?
User (Origin or Impacted) IS NULL
Result: Either Origin or Impacted is NULL. At least one of the fields must be null.Filter Out (Is Not)
User (Origin or Impacted) IS NOT ‘pete’
Result: Neither Origin nor Impacted has the value ‘pete’. Both fields have a value other than ‘pete’- Filter Out (Is Not) Blank with Filter out Null Values?
User (Origin or Impacted) IS NOT NULL
Result: Neither Origin nor Impacted is NULL. Both fields must have a value.
Quantitative Filters
Quantitative filters are available from these LogRhythm tools and utilities:
- Alarm Rules
- GLPR wizard
- Investigator
- Log Distribution Services (LDS )
- Personal Dashboard filters
- Reports
- SecondLook
- Tail
Quantitative fields include:
- Amount
- Bytes Sent and Bytes Rcvd
- Duration
- Packets Sent and Packets Rcvd
- Quantity
- Rate
- Size
The operators for quantitative filters are described in the following table.
| Operator | Description |
|---|---|
| = | Equal to |
| != | Not equal to |
| > | Greater than |
| >= | Greater than or equal to |
| < | Less than |
| <= | Less than or equal to |
| <> | Less than or greater than - (outside range) |
| <=>= | Less or equal to OR greater or equal to - (outside range) |
| >< | Greater than AND less than - (between range) |
| >=<= | Greater or equal to AND less than or equal to - (between range) |
Wildcards in Search Strings
LogRhythm can use wildcards and pattern matching in search string filters to increase flexibility and efficiency. For example:
- Use wildcards to search for a particular sender or recipient email address in the Platform Manager, Data Processor, or LogMart by specifying only some of the characters in the address.
- Filter to find any matches for senders at a given domain name.
- Filter to find a specific host name.