Add or edit criteria in Filter elements

You can add new criteria or edit the criteria of Filters that you have created.

1. Select Configuration, then browse to Monitoring.
2. Browse to Other Elements > Filters > All Filters.
3. Right-click a filter you have created, then select Properties.
   Tip: To edit a filter based on an existing system filter, right-click the filter, then select New > Duplicate.
4. Select the setting for Undefined Value Policy.
   This setting defines how data entries are matched when a field is included in the filter, but is not present in the entry. For example, a filter defines a range of destination ports, but the operation encounters a log entry from a protocol that does not use ports, such as ICMP.
5. If there is no logical operation (AND or OR) at the correct level, add one using the shortcut buttons above the editing pane.
   You can nest logical operations to create more complex filters. For example, you can create two AND sections under an OR condition to match either of the two sets of criteria.
6. To change a logical operation, right-click the operation, select Change To, then select the new operation.
7. To add a field:
   1. Right-click the logical operation to which you want to add a field, then select New > Select.
   2. Click Fields, then browse to the field group that contains the field you want to add, or browse to All Fields for a list of all available fields.
   3. Select the field, then click Select.
8. To edit the field:
   1. Right-click the field that was added, then select Edit.
   2. Select the Comparison.

      The available comparison selection depends on the selected field and whether the field already contains one or more values.

      The most common comparisons are:

      • Any Value — Allows you to match any non-empty value in the field.
      • Between — Allows you to match a range (for example, a range of TCP/UDP ports).
      • Contains — Allows you to match any of several alternative values (for example, both an IPv4 address and an IPv6 address).
      • In — Allows you to match a single value (for example, an IP address or Network element).
   3. Depending on the comparison and type of field, define the values that you want the filter to match in one of the following ways:
      • Enter one or more values. For the In or Contains comparison, click Add to add the entered value to the value list.
      • Double-click the empty space in the value list, then select an element.
      • To edit a value that has been added to the value list, double-click the value.
      • To remove a value, right-click the value, then select Remove.
   4. Click Apply.
9. To remove criteria, right-click the criteria, then select Remove Row or Remove.

   If you select Remove Row, all criteria nested under the row is moved up one level.

   If you select Remove, all criteria nested under the row is also removed.

10. Click OK.