Create local filters

You can create local filters in various views in the Management Client.

1. Open a view or element for editing.
2. Depending on the view or dialog box, create the local filter in one of the following ways:

   View/Dialog box		Configuration steps
   Monitoring views (Logs, Connections, Blacklist, VPN SAs, Users, Routing, or SSL VPNs)		On the Filter tab in the Query pane, click New, then select New > Filter to create a filter from a list of available fields, or select New > Filter:<field name> to create a filter based on a preselected field. Tip: You can also drag and drop log data rows onto the Filter tab
   Reports view	Report Design	Select the name of the Report Design. In the Report Properties pane, click the Select Element button next to the Filter field.
   	Report Section	Select the Report Section. In the Section Properties pane, click the Select Element button next to the Filter field.
   	Report Item	Double-click the Report Item.
   Administrator Properties dialog box		Switch to the Permissions tab. Click Select next to Filter. The Local Filter Properties dialog box opens.
   Log Server Properties or Management Server Properties dialog box		For the Log Server, switch to the Log Forwarding tab, then click Add to add a Log Forwarding rule. For the Management Server, switch to the Audit Forwarding tab, then click Add to add an Audit Forwarding rule. Double-click the Filter cell. The Local Filter Properties dialog box opens.
   Correlation Situation Properties dialog box		Switch to the Context tab. Click Select next to the Context field, then select Compress, Group, Match, or Sequence. For Compress or Match, click Select next to the Compress filter field. The Local Filter Properties dialog box opens. For Group or Sequence, double-click the Event Match cell. The Local Filter Properties dialog box opens.

3. (If not in a Monitoring view) Select Add > New > Filter to create a filter from a list of available fields or Add > New > Filter:<field name> to create a filter based on a preselected field.
4. Edit the filter in the Filter Properties dialog box.
   • If you are creating a filter from a list of available fields, enter an optional name in the Name field. Select the setting for Undefined Value Policy, then define the filtering criteria.
   • If you are creating a filter based on a preselected field, edit the filter properties. The available options depend on the field type.
5. Click Apply.

   The filter is added to the Local Filter Properties dialog box.

   In a Monitoring view, the filter is added to the Filter tab in the Query pane.

6. (Optional) Edit the local filter:
   • To negate a filter row, click the corresponding checkbox. This option filters out entries that match the filter.
   • If a row contains more than one item, click the operator cell to toggle between the and and or operators.

   
   
   

   1

   Negate a filter.

   2

   Toggle between operators.

7. (Optional) To save a local filter as a permanent Filter element, click Save. In a Monitoring view, click Save.
   You can use Filter elements in any view.
8. Click OK. In a Monitoring view, click Apply.