Events browser query builder help

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

Events browser query builder help

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Networking & Security] >> GFI EventsManager >> Events browser query builder help

Page: [1]

Message

<< Older Topic Newer Topic >>

Events browser query builder help - 17.Sep.2009 8:49:02 AM

dhartley

Posts: 11
Score: 0
Joined: 2.Feb.2006
Status: offline

I've made a query like the one below but the filtered results aren't right. The filtered ip addresses still show up. It's probably a small oversight on my part when making the query. I've tried a few different things but I keep getting results other than what I need. I've tried OR NOTs in place of the ORs with the NOTs gone. I've cleared an started over a few times now. I think I just need some fresh eyes to look at it. Thanks in advance.

(NOT Field 14 Contains '192.168.1.1' OR
NOT Field 14 Contains '192.168.1.2' OR
NOT Field 14 Contains ' 192.168.1.3') AND
(Computer Equal To 'Servername' AND
In Work Hours Equal To 'No')

Post #: 1

RE: Events browser query builder help - 17.Sep.2009 9:20:16 AM

DrewE

Posts: 1058
Score: 0
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

What is the EventID you are trying to work with ? Field 14 may not always be the IP address each time in all events.

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to dhartley)

Post #: 2

RE: Events browser query builder help - 17.Sep.2009 9:37:45 AM

dhartley

Posts: 11
Score: 0
Joined: 2.Feb.2006
Status: offline

I realize that but I can run a query like that and events with the specified ip addresses in Field 14 are listed. The events themselves are 538 and 540. Is the logic I used in the query wrong? I'm looking for events that aren't in working hours from a specific computer but not if a specified IP is in field 14.

(in reply to DrewE)

Post #: 3

RE: Events browser query builder help - 17.Sep.2009 1:44:54 PM

dhartley

Posts: 11
Score: 0
Joined: 2.Feb.2006
Status: offline

I figured it out. It was the logic I used. This worked:

(NOT this AND
NOT this AND
NOT this) AND
...the rest...

(in reply to dhartley)

Post #: 4